Actions needed to address cybersecurity risks facing the electric grid (2019) [pdf] | Hacker News Reader

Actions needed to address cybersecurity risks facing the electric grid (2019) [pdf]

gao.gov

55 pointsnotadog16 comments

Worked on this problem 10 years ago, power distribution companies were sleepy enterprise environments with workforces who were just not equipped to respond to internet technologies, let alone threats. Even the lightweight requirements of NERC/CIP were treated as alien. The best security was in the smart meter infrastructure, which was designed around redundancy and combating fraud, but certainly not national security.

I don't think this is something we fix, it's something we evolve and move on from. My impression was the only real future relative to a grid security crisis is in storage and renewables, with more localized generation. The alternative is basically nationalization.

I worked on it back then too. As you say, the power companies have neither the money, the talent, nor the will to fix the problem. Getting a private company to spend money to prevent a hypothetical bad thing is always a tough sell, and most of the US grid is operated by private companies.

This could be fixed by a dramatic demonstration. Pick a medium sized metropolitan area, and authorize pentesters to try and take down the grid to the point of a (short) blackout - and make sure people know how it happened, and that a foreign adversary could do it to us.

(Perhaps an occasional electrical blackout is good for a society in the same way an occasional fast is good for a human body).

This was done a few years back in Switzerland by national television. With the approval of everyone involved, a pentester was supposed to shut down the street lights in a medium-sized town.

The pentester got in, got to the correct controls and "failed" because the UI bugged out. It was rather funny to see the journalist/moderator be relieved, while the rep from the energy company and the security specialist both clearly knew that that was sheer luck and with a little more time the pentester could've gotten around the bug too.

Edit after checking the story again: The hacker thought he found the main control but was wrong and only turned the lights off in a tiny side street. So it did work and the "bug"/"luck" was that the UI was so confusing that the attacker got it wrong :D

We had one in 2007. Didn't seem to change much.

https://en.wikipedia.org/wiki/Aurora_Generator_Test

> Even the lightweight requirements of NERC/CIP were treated as alien.

I work in ICS for a wind company and this is shocking...even when you're working with other entities (regional, ISO, etc) in the same industry. Some entities don't even bother reading the details of NERC CIP V and completely bans you from even accessing their meters.

This is one of those things that I hear the security community talking about a lot, but it has very little mainstream traction.

This actually surprises me because I would intuit that people would be drawn to hysterics about massive grid failures. Look at what happened in New York City.

And there are many smaller things that get even less consideration. Like the Tesla Powerwall Hack [0]

Either some big incident is going to happen that makes us shape up real quick, or we’re going to have a little foresight and proactively upgrade the security of our critical infrastructure.

[0] https://news.ycombinator.com/item?id=21610981

The senate passed a bill to study moving various electrical digital systems back to analog/manual control:

https://www.utilitydive.com/news/senate-passes-cybersecurity...

It is poor decision making putting power systems on the internet.

All power companies have end to end land access and already have scada etc physical links between all switchyards and can run their own microwave links where necessary so no need for ANY infrustructure to be accecible from the internet.

Its lazy cheap decision making.

Have they ever given consideration to not connecting the Electric Grid to the Internet?

How would I turn the power back on when it goes out? It would be a 6 hour drive for me to the power plant. I’ll take my odds with the VPN and satellite internet connection! If someone wants to cause an outage they can drive their car in to a power pole, have an earthquake drop rocks off a bank and crush the pen stocks, have a river change its course and take out 10 poles, send little animals on to the insulators to cause short circuits, have branches fall on the power lines, have droughts make the power plant run out of water... all those things already happened. if some nerd hacks in to my PLC they can’t do anything worse than I’ve already done! Someone physically breaking in to the building could cause a lot more damage, they could just burn it down!!

> send little animals on to the insulators to cause short circuits

You don't even need to do that as it happens organically. At my company, we had a comms outage to a wind farm for several days (and the outage was wide enough where even surrounding wind farms outside of my company were affected) and just two days ago, the LEC (Frontier) discovered a bird build a nest in one of the junction boxes which links up to all the plants. All of this happened in a span of five days or so.

Somewhat related, but the book Countdown to Zero Day is about both the Stuxnet worm and the potential for digital attacks on infrastructure. Very good read and intro to the topic. https://www.amazon.com/dp/B00KEPLC08/

There's actually a more recent book, Sandworm, which is specifically about cyberattacks on the power grid (in Ukraine). Recommended.

Sadly it looks like they have won so comprehensively.... they have stopped boasting...

https://cybersquirrel1.com/

The cybersquirrels have won.

This is my favourite: https://web.archive.org/web/20150827145912/https://au.news.y...

I remember reading a commentary on the cybersquirrel1 site introducing this "event" along the lines of: "In one of our more unusual operations..."

What this site beautifully illustrates is the entirely lax physical security of power substations and other distribution infrastructure that hundreds or thousands of households depend on. A distributed, coordinated human effort could destroy enough infrastructure to cause multiple days if not weeks of no electricity for a significant area. The kind of damage that would require the infrastructure to need rebuilding from scratch, or close to it.

Reply on news.ycombinator.com