'Smart Grid' may be is vulnerable to hackers!

 

http://www.cnn.com/2009/TECH/03/20/smartgrid.vulnerability/index.html

 

CNN broke the story this weekend. In the story, IOActive determined that attackers are able to “take command and control” of the advanced meter infrastructure. Big news? No.

 

The article goes on with expert claims about blackout scenarios.  Indeed, have Kaminsky and IOActive, (the guys who discovered the internet-wide DNS flaw) turned attention to the power grid?

 

If so, hurrah! The more ‘good’ guys looking at the smart grid security the better.  It's kind of interesting just 10 days prior, the AMI-SEC task force released AMI System Security Requirements.  This specification helps people understand just how big the application space is for AMI and Smartgrid. There will be bugs and some will be security bugs.  Full Disclosure (OSIsoft is a member of UCA, the parent organization sponsoring AMI-SEC).

 

Waiting to solve all the security challenges is not really an option. Most security experts will tell you there is no end game in pursuit of a perfectly secure network, computer system or smart meter. You simply can’t prove absence of a bug.

 

All control systems should be implemented with a cyber security defense in depth strategy to slow and deter hackers.  PI is frequently one or more of the layers in security topology.  We expect security performance and monitoring in PI will also be one of the application topologies for AMI/Smartgrid implementations.

 

One of the reasons I like this approach is the potential to implement sanity checks on commands at a higher level.  So you want to disconnect a meter due to a move out, what’s the current load? Is there a load on the meter, does the load exceed historical norms for the intended customer? Are parent transformer and substation assets healthy?  These kind of checks will be difficult to implement in the head end system or final control elements.

 

Sure, I’d bet my bottom dollar that IOActive has found a flaw in AMI or SmartGrid technology. I've even seen demonstrations where encryption keys have been extracted from chips using hypodermic needles as conductor leads (Yes, smart meter circuits are now being physically secured in a block of epoxy).  But let’s be serious, the control logic to simultaneously open thousands or millions of meters doesn’t exist.  Target a main breaker on the EMS system, now that’s a juicy target.