Cyber Threat and Vulnerability Analysis of the U.S. Electric Sector

Abstract: 

With the expansion of Internet connectivity and communication methods that has accompanied the modernization of the U.S. power grid (i.e. the development of the “smart grid”), the range of possible attack vectors into the grid has increased. This has manifested in an increase of reports of cyber attacks against utilities over the last few years. Though utility operators understand the severity of the threat posed by cyber attacks, there is a general lack of knowledge about how to best to position themselves defensively against these threats, a critical shortcoming that must be addressed. This paper both outlines the overall topography of the US power grid systems as it relates to cybersecurity, and sheds light on “utility perspectives, perceived challenges, and requests for assistance in addressing cyber threats to the electric sector.” In terms of the perspectives of the utility sector, some interesting results of this paper are the following: (1) Utilities often don’t have a full understanding of how prepared they are with respect to responding to cyber attacks, due to understaffed cybersecurity divisions and/or a lack of resources. (2) Governmental regulatory standards are often functionally opaque due to the fact that they only describe outcomes that should result from a strong cybersecurity strategy, but not how utility operators should implement their systems to achieve those outcomes. In addition, the existence of a diversity of different sets of guidelines has produced confusion, and is an obstacle to performing an assessment of cybersecurity hygiene in the industry as well as determining best practices. (3) Utilities expect more from the government in terms of being informed about potential threats (information sharing). Although it remains unlikely that a full “cyber-apocalypse” as the media might describe it will occur, it is clear from these findings that more cohesive collaboration between the government and the energy sector is needed to fix existing vulnerabilities.

Author: 

Idaho National Laboratory: Mission Support Center

Year: 

2016

Domain: 

Dimension: 

Region: 

Country: 

United States

Data Type: 

Keywords: