Wow! It truly amazes me to hear that the CEO of a large utility is speaking up about the importance of cyber security in the Smart Grid. Tom Fanning of Southern Company has made the news in the past few days with his declaration that "cyber security issues must be resolved before a so-called smart electricity grid can be fully built" and "Southern Co. hires hackers to identify vulnerabilities" and "the power company gets attacked frequently."
Okay, now let's be fair here. Southern Company is not the only utility that cares about security, and they are not the only utility that hires hackers to identify vulnerabilities. They are, however, the ONLY utility I am aware of where the CEO has decided to come forward and speak out about their security posture publicly.
Why is this so significant? Simply put, this is a declaration at the highest level in an organization that security has not been relegated to a lower position. It is a declaration that "the buck stops here" with respect to security. You got my respect, Mr. Tom Fanning!
So what else has Southern Company done to back this security stance? Well, let me tell you.
Southern Company is the FIRST utility I know of in the entire USA to force a vendor to CERTIFY the security of their product through a third party. Yes, you heard that correctly, they essentially told their AMI vendor (SENSUS) that if they wanted to do business with Southern Company, they had to submit to the Wurldtech Achilles Practices Certification (APC) process. SENSUS went through this process, and achieved Bronze Level Certification. The Wurldtech Achilles Practices Certification is a certification program originally designed to certify vendors for the Gas and Oil industry, and the requirements are outlined in a document known as the WIB, which is a set of security evaluation requirements originally initiated in The Netherlands by Wurldtech and Royal Dutch Shell. Wurltdtech worked with Southern Company to scope a set of certification requirements that could be applied to the electric industry, and SENSUS immediately went to work. The rest is history.
Wurldtech did not stop there, however. Nate Kube of Wurldtech and Ted Angevaare of Shell Oil worked with standards veterans Dennis Holstein and Tom Phinney, who have submitted the WIB requirements to the International Electrotechnical Commission (IEC) as a proposal known as IEC 62443-2-4.
Upon learning about this, I decided to get involved. I have been working closely with NIST, OpenSG, and the DHS ICSJWG for the better part of two years in trying to get some baseline security standards in place for the Smart Grid. When I learned about what Southern Company had done, and that it had led to a proposed international standard, I knew this was significant. I immediately communicated this information to Marianne Swanson of NIST (who is currently chairing the NIST Smart Grid Interoperability Panel Cyber Security Working Group), and she asked me if I would be willing to take the lead in aligning the IEC requirements with the NIST IR 7628 security requirements. I agreed to do so, and was immediately joined by several of the most active members of the NIST CSWG in building this task force. I was also selected as a member of the US Technical Advisory Group for TC65 (the working group for the IEC 62443-2-4 proposed standard). Since then, I have managed to engage several large AMI vendors, silicon producers, security product vendors, and consultants in the process. According to Ward Pyles, Security Analyst at Southern Company, and Nate Kube of Wurldtech, several other utilities in the USA and overseas have now become involved in the process.
What is so significant about this is the fact that it took the EXTRAORDINARY leadership of Southern Company to plant a stake in the ground, and demand that their vendors go the extra step towards assuring that a security baseline had been met. What we all must understand is that the utility is the customer to the Smart Grid product vendor, and the vendor WILL build security into their products if the utility demands it, and forcing a vendor to certify to a third party audit is the only true assurance that a baseline is being met during procurement. It is still critically important for a utility to perform their own security validation (which Southern Company does), but knowing what the baseline is up front saves the vendor, the utility, and the rate payer (you and I) a lot of time and money.
I hope other utilities follow the lead that Southern Company has established.
Saturday, June 4, 2011
Sunday, May 1, 2011
James Lewis, Peter Schiff, Nassim Nicholas Taleb
I remember buying my first home (the one I still live in today) back in 2003. I remember the mortgage broker cajoling me to take advantage of the no money down loans that were being handed out like candy, and watching a world where everyone I knew was jumping on the gravy train. I took on a primary and secondary loan. One at a crazy high interest rate, and the other was interest only. Everyone was doing it, and there seemed to be no risk involved. Homes were skyrocketing in value (mine rose a WHOPPING 60% in value before the crash of 2008), and everyone was making money.
It made no fianancial sense whatsoever to me, and it certainly did not make financial sense to Peter Schiff. He was the guy that people laughed at on FOX News interviews for claiming that the market was going to collapse. Nassim Nicholas Taleb also felt it was all going to end in a bad way, and said so in his book "The Black Swan". I would recommend everyone alive today read this book.
So, this morning I read an article on Infosecurity.com titled "Cybersecurity threat rhetoric not supported by evidence, researchers argue", which references a paper written by Jerry Britto and Tate Watkins of George Mason University. It is a well written paper. It is well cited and referenced, and I am sure Britto and Watkins are a couple of smart guys. The paper refers to another paper "Securing Cyberspace for the 44th Presidency: A Report of the CSIS Commission on Cybersecurity for the 44th Presidency", which was a product of a project directed by James A. Lewis, who is the senior fellow and director of the Technology and Public Policy Program at the Center for Strategic and International Studies (CSIS). Britto and Watkins are critical of some of the assertions in the CSIS paper, and I can certainly follow their logic. For example, here is a quote from the Britto and Watkins paper:
"Nevertheless, the Commission report and the cybersecurity bills it inspired prescribe regulation of the Internet. The report asserts plainly: “It is undeniable that an appropriate level of cybersecurity cannot be achieved without regulation, as market forces alone will never provide the level of security necessary to achieve national security objectives.”52 But without any verifiable evidence of a threat, how is one to know what exactly is the “appropriate level of cybersecurity” and whether market forces are providing it? How is one to judge whether the recommendations that make up the bulk of the Commission’s report are necessary or appropriate?"
I cannot argue against the point that without empirical evidence, one cannot determine what is an appropriate level of security, IF an appropriate level of security is predicated by empirical evidence bound by a narrowly defined context.
So what the heck am I trying to say here? Let's go back to the financial collapse of 2008. Despite the assertions made by Schiff and Taleb that the financial situation was headed for disaster (and they were not the only ones predicting this), the "geniuses" in the high towers and in the hallowed halls of our government sponsored institutions decided that there simply was not enough evidence to get them to change their ways. This was despite the fact that we had lived through a Great Depression, and despite the fact that financial analysts interviewed after the collapse claimed that they had indeed told those in charge the that things were not going to end well (and in some cases were terminated for saying so). This was a new way of doing business, as some claimed, and the old rules did not apply. Everyone is making money, so shut up and don't rock the boat.
So the market did collapse after all. We now have LOTS of empirical evidence that our privately run financial system gave us the shaft, and yet some of the very instruments that led to the financial demise of millions of people worldwide remain unregulated.
So this leads me to the conclusion of the Britto and Watkins paper:
"Cybersecurity is an important policy issue, but the alarmist rhetoric coming out of Washington that focuses on worst-case scenarios is unhelpful and dangerous. Aspects of current cyber policy discourse parallel the run-up to the Iraq War and pose the same dangers. Pre-war threat inflation and conflation of threats led us into war on shaky evidence. By focusing on doomsday scenarios and conflating cyber threats, government officials threaten to legislate, regulate, or spend in the name of cybersecurity based largely on fear, misplaced rhetoric, conflated threats, and credulous reporting. The public should have access to classified evidence of cyber threats, and further examination of the risks posed by those threats, before sound policies can be proposed, let alone enacted.
Furthermore, we cannot ignore parallels between the military-industrial complex and the burgeoning cybersecurity industry. As President Eisenhower noted, we must have checks and balances on the close relationships between parties in government, defense, and industry. Relationships between these parties and their potential conflicts of interest must be considered when weighing cybersecurity policy recommendations and proposals.
Before enacting policy in response to cyber threats, policymakers should consider a few things. First, they should end the cyber rhetoric. The alarmist rhetoric currently dominating the policy discourse is unhelpful and potentially dangerous. Next, they should declassify evidence relating to cyber threats. Overclassification is a widely acknowledged problem, and declassification would allow the public to verify before trusting blindly. They must also disentangle the disparate cyber threats so that they can determine who is best suited to address which threats. In cases of cyber crime and cyber espionage, for instance, private network owners may be best suited and may have the best incentive to protect their own valuable data, information, and reputations. After disentangling threats, policymakers can then assess whether a market failure or systemic problem exists when it comes to addressing each threat. Finally, they can estimate the costs and benefits of regulation and its alternatives and determine the most effective and efficient way to address disparate cyber threats.
No one wants a “cyber Katrina” or a “digital Pearl Harbor.” But honestly assessing cyber threats and appropriate responses does not mean that we have to learn to stop worrying and love the cyber bomb."
While I have to agree that being alarmist tends to turn some people off, I cannot help but think of the tongue-in-cheek saying "Just because I'm paranoid doesn't mean they're not watching me." I wholeheartedly agree that our government is not good at spending our money in a reasonable manner, and I feel they do not spend our money wisely even when given correct and verifiable information. In fact, I currently have very little evidence to support that our government does anything based on a well thought out assessment of facts. While Mason and Britto point out a plausible and seemingly correct way to go about this, perhaps they should consider that Mr. Lewis does indeed live in a world where he faces policy makers regularly, and there seems to be no hurry to address the issues at hand. Furthermore, in January of 2011 (this year) CSIS published a followup to the previous paper titled "Cybersecurity Two Years Later" where some specific significant attacks are cited:
"2010 should have been the year of cybersecurity. It began with a major penetration of Google and other Fortune 500 companies, saw the Department of Defense describe how its classified networks had been compromised, watched the Stuxnet worm cut through industrial control systems, and ended with annoying denial of service attacks over Wikileaks. These public incidents were accompanied by many other exploits against government agencies, companies, and consumers. They show how the United States is reliant on, but cannot secure, the networks of digital devices that make up cyberspace. As a nation, we must do more to reduce risk, and we must do it soon."
The report also points to a document titled "Significant Cyber Incidents Since 2006", which (as of the date this blog was posted) list 70 significant incidents (not only in the US).
So how do we solve this problem? Making claims that "the sky is falling" tends to lead to public ridicule (Schiff and Taleb know that well). Theoretical attacks tend to become marginalized ignored due to a critical flaw in risk based formulas that tends to zero out risk for attacks that have never occurred (which is what I am presenting on at the ICSJWG conference on May 3rd, 2011 in Dallas). Finally, empirical evidence only seems to lead to some policy changes as long as it is accompanied by an alarmist outcry (e.g. Congress made some minor changes to our financial system while the world was screaming about the collapse of our economy, but seemed to wind down when the crying stopped, and the risks still exist despite plenty of empirical evidence).
The reality is this: We are not going to do much about cybersecurity until we all feel it in a major way, and then maybe we will get better at dealing with the issues, but maybe not.
One thing is certain, however, Mr. Lewis and the CSIS team will suddenly seemed a lot smarter.
By the way, I got into a less risky loan a year after buying my house. The alarmist rhetoric hit home with me.
It made no fianancial sense whatsoever to me, and it certainly did not make financial sense to Peter Schiff. He was the guy that people laughed at on FOX News interviews for claiming that the market was going to collapse. Nassim Nicholas Taleb also felt it was all going to end in a bad way, and said so in his book "The Black Swan". I would recommend everyone alive today read this book.
So, this morning I read an article on Infosecurity.com titled "Cybersecurity threat rhetoric not supported by evidence, researchers argue", which references a paper written by Jerry Britto and Tate Watkins of George Mason University. It is a well written paper. It is well cited and referenced, and I am sure Britto and Watkins are a couple of smart guys. The paper refers to another paper "Securing Cyberspace for the 44th Presidency: A Report of the CSIS Commission on Cybersecurity for the 44th Presidency", which was a product of a project directed by James A. Lewis, who is the senior fellow and director of the Technology and Public Policy Program at the Center for Strategic and International Studies (CSIS). Britto and Watkins are critical of some of the assertions in the CSIS paper, and I can certainly follow their logic. For example, here is a quote from the Britto and Watkins paper:
"Nevertheless, the Commission report and the cybersecurity bills it inspired prescribe regulation of the Internet. The report asserts plainly: “It is undeniable that an appropriate level of cybersecurity cannot be achieved without regulation, as market forces alone will never provide the level of security necessary to achieve national security objectives.”52 But without any verifiable evidence of a threat, how is one to know what exactly is the “appropriate level of cybersecurity” and whether market forces are providing it? How is one to judge whether the recommendations that make up the bulk of the Commission’s report are necessary or appropriate?"
I cannot argue against the point that without empirical evidence, one cannot determine what is an appropriate level of security, IF an appropriate level of security is predicated by empirical evidence bound by a narrowly defined context.
So what the heck am I trying to say here? Let's go back to the financial collapse of 2008. Despite the assertions made by Schiff and Taleb that the financial situation was headed for disaster (and they were not the only ones predicting this), the "geniuses" in the high towers and in the hallowed halls of our government sponsored institutions decided that there simply was not enough evidence to get them to change their ways. This was despite the fact that we had lived through a Great Depression, and despite the fact that financial analysts interviewed after the collapse claimed that they had indeed told those in charge the that things were not going to end well (and in some cases were terminated for saying so). This was a new way of doing business, as some claimed, and the old rules did not apply. Everyone is making money, so shut up and don't rock the boat.
So the market did collapse after all. We now have LOTS of empirical evidence that our privately run financial system gave us the shaft, and yet some of the very instruments that led to the financial demise of millions of people worldwide remain unregulated.
So this leads me to the conclusion of the Britto and Watkins paper:
"Cybersecurity is an important policy issue, but the alarmist rhetoric coming out of Washington that focuses on worst-case scenarios is unhelpful and dangerous. Aspects of current cyber policy discourse parallel the run-up to the Iraq War and pose the same dangers. Pre-war threat inflation and conflation of threats led us into war on shaky evidence. By focusing on doomsday scenarios and conflating cyber threats, government officials threaten to legislate, regulate, or spend in the name of cybersecurity based largely on fear, misplaced rhetoric, conflated threats, and credulous reporting. The public should have access to classified evidence of cyber threats, and further examination of the risks posed by those threats, before sound policies can be proposed, let alone enacted.
Furthermore, we cannot ignore parallels between the military-industrial complex and the burgeoning cybersecurity industry. As President Eisenhower noted, we must have checks and balances on the close relationships between parties in government, defense, and industry. Relationships between these parties and their potential conflicts of interest must be considered when weighing cybersecurity policy recommendations and proposals.
Before enacting policy in response to cyber threats, policymakers should consider a few things. First, they should end the cyber rhetoric. The alarmist rhetoric currently dominating the policy discourse is unhelpful and potentially dangerous. Next, they should declassify evidence relating to cyber threats. Overclassification is a widely acknowledged problem, and declassification would allow the public to verify before trusting blindly. They must also disentangle the disparate cyber threats so that they can determine who is best suited to address which threats. In cases of cyber crime and cyber espionage, for instance, private network owners may be best suited and may have the best incentive to protect their own valuable data, information, and reputations. After disentangling threats, policymakers can then assess whether a market failure or systemic problem exists when it comes to addressing each threat. Finally, they can estimate the costs and benefits of regulation and its alternatives and determine the most effective and efficient way to address disparate cyber threats.
No one wants a “cyber Katrina” or a “digital Pearl Harbor.” But honestly assessing cyber threats and appropriate responses does not mean that we have to learn to stop worrying and love the cyber bomb."
While I have to agree that being alarmist tends to turn some people off, I cannot help but think of the tongue-in-cheek saying "Just because I'm paranoid doesn't mean they're not watching me." I wholeheartedly agree that our government is not good at spending our money in a reasonable manner, and I feel they do not spend our money wisely even when given correct and verifiable information. In fact, I currently have very little evidence to support that our government does anything based on a well thought out assessment of facts. While Mason and Britto point out a plausible and seemingly correct way to go about this, perhaps they should consider that Mr. Lewis does indeed live in a world where he faces policy makers regularly, and there seems to be no hurry to address the issues at hand. Furthermore, in January of 2011 (this year) CSIS published a followup to the previous paper titled "Cybersecurity Two Years Later" where some specific significant attacks are cited:
"2010 should have been the year of cybersecurity. It began with a major penetration of Google and other Fortune 500 companies, saw the Department of Defense describe how its classified networks had been compromised, watched the Stuxnet worm cut through industrial control systems, and ended with annoying denial of service attacks over Wikileaks. These public incidents were accompanied by many other exploits against government agencies, companies, and consumers. They show how the United States is reliant on, but cannot secure, the networks of digital devices that make up cyberspace. As a nation, we must do more to reduce risk, and we must do it soon."
The report also points to a document titled "Significant Cyber Incidents Since 2006", which (as of the date this blog was posted) list 70 significant incidents (not only in the US).
So how do we solve this problem? Making claims that "the sky is falling" tends to lead to public ridicule (Schiff and Taleb know that well). Theoretical attacks tend to become marginalized ignored due to a critical flaw in risk based formulas that tends to zero out risk for attacks that have never occurred (which is what I am presenting on at the ICSJWG conference on May 3rd, 2011 in Dallas). Finally, empirical evidence only seems to lead to some policy changes as long as it is accompanied by an alarmist outcry (e.g. Congress made some minor changes to our financial system while the world was screaming about the collapse of our economy, but seemed to wind down when the crying stopped, and the risks still exist despite plenty of empirical evidence).
The reality is this: We are not going to do much about cybersecurity until we all feel it in a major way, and then maybe we will get better at dealing with the issues, but maybe not.
One thing is certain, however, Mr. Lewis and the CSIS team will suddenly seemed a lot smarter.
By the way, I got into a less risky loan a year after buying my house. The alarmist rhetoric hit home with me.
Wednesday, April 27, 2011
Trivial Key Extraction From Electromagnetic Emissions
I am at day 2 of a 2 day workshop at Cryptography Research in San Francisco, California. The focus of this workshop is on side channel attacks using both Power Analysis (SPA and DPA) and EM analysis to extract secrets (such as keys) from various systems and devices. By far, the most interesting demonstration I have seen is one where both RSA and ECC keys are extracted from a mobile device using a hobbyist antenna and some basic equipment (and software tools developed by Cryptography Research). The total cost for the equipment is less than $2000 (even less if you scrounge around on Ebay, to be sure).
In this attack, a mobile device performing a cryptographic operation is held 10 feet away from an antenna, and with a few seconds of signal sampling, they are able to extract a key by analyzing peaks on a spectrograph. One of the questions I asked is if a more powerful antenna could potentially read the EM from a longer distance, and was told that by simply focusing a parabolic dish at a target (similar to what has been done for reading long distance WiFi signals), the traces can be gathered from very long distances.
I found this quite fascinating, since I am not sure what (if any) protection currently exists for products being used in Smart Grid deployments. There are indeed ways to protect devices against both EM and SPA/DPA attacks, but I am currently unaware of what protections exist. Moreover, as we learned in the workshop, typically most devices "leak" this information in more ways than one, and what they typically discover in many implementations they test, known simple EM,SPA,DPA attack vectors are not considered during engineering (not always, but often enough to furrow ones brow).
I am not sure how serious an issue this may be, but it does raise some concern, when you consider that an attacker does not necessarily have to set foot on someone's property to gather enough information to extract a key from something like a meter (or a cellphone, or anything else where secrets may be stored). One of the basic tenants of protecting against attacks is to prevent scalable attacks. In other words, design the system so that if I get one secret I can only do one bad thing, and make it hard enough to get multiple secrets that an attacker simply gets exhausted with the "workload", and moves on to something else. If an attacker has to get his hands on each and every device to perform an attack, one can see how this becomes non-trivial. However, if an attacker can focus an antenna setup at (for example) a bank of meters on a wall for an apartment complex, now you may have something to write home about.
For those of you not familiar with Cryptography Research Inc., you can find out more about them at www.cryptography.com . Paul Kocher, who is one of the founders, is co-creator of SSL 3.0. This is a well established, and well respected research organization, with an impressive pedigree.
I have a video of Gilbert Goodwill from Cryptography Research (one of the workshop instructors) demoing an EM attack at RSA 2011 on my YouTube channel:
Forgive the background noise (the RSA Expo Hall is quite noisy). They will be demoing this at my EnergySec Smart Grid Security Summit in October, 2011.
This is indeed something to think about.
Thursday, April 7, 2011
Executive Level Apathy For Security...Maybe Not So Much
I read an article in Information Week this morning titled "76% Of Energy Utilities Breached In Past Year", and while I found most of it rather sensationalistic and perhaps a bit boorish (I mean, c'mon, 76% of all businesses AND government agencies have probably been breached in the past year...at least according to the boundaries defined in this article), one part stood out:
"71% of people surveyed said that "the management team in their organization does not understand or appreciate the value of IT security."...Executive-level apathy or misunderstanding over information security is surprising..."
I have been thinking about this notion of "Executive Level Apathy" for a while now, and I have come to the conclusion that executives are doing exactly what anyone would do if put in their positions and under the circumstances. Hear me out for a moment before throwing daggers.
One of the primary (if not THE primary) responsibilities of a CEO of an investor owned utility is to make sure the investors get what they paid for. This can include anyone that invests in mutual funds and ETFs that include utility stocks as part of their portfolios. When those stock prices (and dividends) go up, everyone is happy. When they drop, everyone gets grouchy. Anyone who invests knows the scene quite well.
There are a lot of factors that cause stock values to fluctuate, but suffice it to say that the more money a company spends on things that do not generate a return on investment, the lower the bottom line becomes. In some cases utilities have to deal with MASSIVE expenditures fixing problems that, while they are fully responsible for them, generate no ROI (e.g. explosions, environmental messes). I am talking about very real issues that are vivid in nature, and absolutely have to make it to the top of the list of "things we gotta take care of like yesterday".
So lets circle back around to security. In the article the author points out that the average cost of fixing one of these breaches at an energy utility was $156,000. If we take a look at my local utility (PG&E) revenues for 2010, a quick search on the Internet reveals that they took in $13.8 billion dollars. That comes out to 0.00113%. So, let's assume that PG&E maybe gets hit a bit more than the "average" reported by writer of this article. Lets assume they get hit 100 times more, for a grand total of $15,600,000. That brings us to a "whopping" 0.113%.
Okay, I am not saying they should not be concerned with security, but when one considers the costs of doing business and managing budgets on a great scale, it is easy to see that a $156,000 (or even $15,600,000) problem can work it's way down the list of "things I gotta deal with right away as the CEO".
Don't misunderstand me, I dislike filthy rich CEOs like any other red-blooded American worrying about paying his mortgage in our tough economy (although I am perhaps more jealous than anything else), but my very inquisitive nature forces me to peel back the layers of the onion enough to at least try to get some perspective on this, and the truth is that a 0.00113% to 0.113% problem is not something to get worked up about. We, as a society, have created a specific role for such top level executives which FORCES them to focus on what really matters, and today that is measured in the short term (1 budget quarter at a time).
It is, however, VITALLY important to pay attention to security (and CEOs know this) because there is a potential for a MASSIVE loss in revenues given the right circumstances, but how is anyone to know what the right amount of money is to spend on managing the issue? If a company spends $1 million, $5 million, or $20 million to protect themselves against such breaches (and potentially larger ones), how do we determine if it is enough? As stockholders we end up paying for it, and that does not usually make us happy. As customers we also pay for it, because utilities are guaranteed recovery (from us) for such expenditures.
So how much are we all willing to pay for security?
We, as a society, generally get what we demand...eventually. While it may sometimes seem like executive apathy abounds, the truth is that WE are just as apathetic (hopefully not me, but as a society in general) about security. Consumers are simply not demanding security...and what would they demand anyway? With SUBSTANTIALLY less than 1% loss to cybersecurity breaches today in the utility space, what kind of empirical information is likely to motivate a consumer?
Utilities can always do more, and executives can always be more concerned, but exactly how much more should they do, and how much more should they be concerned? Frankly, until something really bad happens, I am not sure anyone will be able to answer that question.
Sorry if this seems like a downer to the security minded (and believe me, I am one of them), but I can't really demonize the guys in the high towers on this one. I would like to see them speak publicly about cybersecurity issues, and that is something they could do as a form of outreach to the community, but in terms of being more pro-active, I certainly don't see how I would (or could) do anything different.
Just my opinion. Take it for what it's worth.
"71% of people surveyed said that "the management team in their organization does not understand or appreciate the value of IT security."...Executive-level apathy or misunderstanding over information security is surprising..."
I have been thinking about this notion of "Executive Level Apathy" for a while now, and I have come to the conclusion that executives are doing exactly what anyone would do if put in their positions and under the circumstances. Hear me out for a moment before throwing daggers.
One of the primary (if not THE primary) responsibilities of a CEO of an investor owned utility is to make sure the investors get what they paid for. This can include anyone that invests in mutual funds and ETFs that include utility stocks as part of their portfolios. When those stock prices (and dividends) go up, everyone is happy. When they drop, everyone gets grouchy. Anyone who invests knows the scene quite well.
There are a lot of factors that cause stock values to fluctuate, but suffice it to say that the more money a company spends on things that do not generate a return on investment, the lower the bottom line becomes. In some cases utilities have to deal with MASSIVE expenditures fixing problems that, while they are fully responsible for them, generate no ROI (e.g. explosions, environmental messes). I am talking about very real issues that are vivid in nature, and absolutely have to make it to the top of the list of "things we gotta take care of like yesterday".
So lets circle back around to security. In the article the author points out that the average cost of fixing one of these breaches at an energy utility was $156,000. If we take a look at my local utility (PG&E) revenues for 2010, a quick search on the Internet reveals that they took in $13.8 billion dollars. That comes out to 0.00113%. So, let's assume that PG&E maybe gets hit a bit more than the "average" reported by writer of this article. Lets assume they get hit 100 times more, for a grand total of $15,600,000. That brings us to a "whopping" 0.113%.
Okay, I am not saying they should not be concerned with security, but when one considers the costs of doing business and managing budgets on a great scale, it is easy to see that a $156,000 (or even $15,600,000) problem can work it's way down the list of "things I gotta deal with right away as the CEO".
Don't misunderstand me, I dislike filthy rich CEOs like any other red-blooded American worrying about paying his mortgage in our tough economy (although I am perhaps more jealous than anything else), but my very inquisitive nature forces me to peel back the layers of the onion enough to at least try to get some perspective on this, and the truth is that a 0.00113% to 0.113% problem is not something to get worked up about. We, as a society, have created a specific role for such top level executives which FORCES them to focus on what really matters, and today that is measured in the short term (1 budget quarter at a time).
It is, however, VITALLY important to pay attention to security (and CEOs know this) because there is a potential for a MASSIVE loss in revenues given the right circumstances, but how is anyone to know what the right amount of money is to spend on managing the issue? If a company spends $1 million, $5 million, or $20 million to protect themselves against such breaches (and potentially larger ones), how do we determine if it is enough? As stockholders we end up paying for it, and that does not usually make us happy. As customers we also pay for it, because utilities are guaranteed recovery (from us) for such expenditures.
So how much are we all willing to pay for security?
We, as a society, generally get what we demand...eventually. While it may sometimes seem like executive apathy abounds, the truth is that WE are just as apathetic (hopefully not me, but as a society in general) about security. Consumers are simply not demanding security...and what would they demand anyway? With SUBSTANTIALLY less than 1% loss to cybersecurity breaches today in the utility space, what kind of empirical information is likely to motivate a consumer?
Utilities can always do more, and executives can always be more concerned, but exactly how much more should they do, and how much more should they be concerned? Frankly, until something really bad happens, I am not sure anyone will be able to answer that question.
Sorry if this seems like a downer to the security minded (and believe me, I am one of them), but I can't really demonize the guys in the high towers on this one. I would like to see them speak publicly about cybersecurity issues, and that is something they could do as a form of outreach to the community, but in terms of being more pro-active, I certainly don't see how I would (or could) do anything different.
Just my opinion. Take it for what it's worth.
Sunday, April 3, 2011
OpenSG And How Utilities Are Missing Out In Smart Grid Security Opportunities
Industry groups are often a good thing for the industries they exist for. Industry groups allow member organizations to converge and discuss ideas, and hopefully come up with a unified way to improve stakeholder positions.
In order for an industry group to create value for the industry it serves, it is important to have a lot of participation by stakeholders. It is also important to make sure that stakeholder participation is not skewed to serve one (or more) stakeholder categories over others.
This brings me to OpenSG. For those not familiar with OpenSG (Open Smart Grid), it is a subcommittee created under the UCAIug (UCA International Users Group) to facilitate the creation and adoption of standards, methods, and guidelines for Smart Grid deployment. This is a utility industry group, and the intended outcome of the work being done under OpenSG is to come up with a consensus based set of standards and guidelines for all utilities deploying Smart Grid.
Under the OpenSG umbrella, there exists an SG Security Working group, and I have been involved with this group for approximately 1 1/2 years. In this time (and before I threw my hat in), there has been a lot of progress, and one can view some of the output by going to http://www.smartgridipedia.org/. One of the more notable pieces of work output is AMI Security Profile 2.0. This document was used by NIST (among other documents) to assist in the creation of the vaunted NISTIR 7628 document, and is currently being utilized by some larger utilities (such as PG&E) as a guideline for AMI security deployment.
I could go on and on about the task forces under the SG Security Working Group (such as the newly formed Embedded Security Task Force), but this is a blog posting, and keeping it short is important.
Okay, so let me tell you what concerns me. The OpenSG SG Security Working Group is quite vendor heavy, and utility light. Sure, we have great participation by some of the "big boys" (e.g. PG&E, SCE, Southern Company, Virginia Dominion, FPL), but we have nowhere near an adequate quorum of utilities participating in OpenSG. When you consider there are over 2300 investor owned utilities in the USA, as an industry group I would suggest that at least 50% (or 1150) of those utilities should be ACTIVELY involved.
Why is this important? Well, if it is not already obvious, because utilities probably have a better idea of how their industry works than the vendors do. Every stakeholder that makes up any industry group is there for one reason, and that is to discover and create opportunities for commerce, or protect their current business model and bottom line (and hopefully make it fatter). This is normal human nature in the business world, so spare the daggers.
In a vendor heavy environment, the industry group is obviously skewed in favor of the stakeholders who do not have the most at stake. Security decisions made by utilities are decisions that are going to have far reaching impact for a long time. While some may find comfort in the fact that large utilities are participating with vendors in making decisions for the industry (and regardless of participation in OpenSG the decisions made by the big boys will affect every utility), it is not wise to assume that what is good for the big utilities is good for the little guys as well. There is a SIGNIFICANT difference between the security management and deployment capabilities of a utility with 5000 employees and one with 20 employees (or even less). If vendors and large utilities decide on something like (as an example) a utility managed PKI system for key management, and products are designed to work with such a system, then a small utility may be a bit hampered in their ability to comfortably deploy.
I am not saying that the SG Security Working Group is not cognizant of this. We certainly are and discuss it regularly. However, without DIRECT input from the ACTUAL stakeholder organizations, we are forced to make educated guesses, and rely on extrapolation and conjecture in our decision making process.
Utilities who are preparing to deploy Smart Grid technologies have lots of questions and more than a few concerns about security. There are a lot of very brilliant people working in OpenSG that are happy to freely share a wealth of information about Smart Grid security, and we can all learn from more participation. We are still at an embryonic state with respect to Smart Grid security, so a little participation is sure to gain anyone who participates a lot of expertise over a short period of time.
Come on in. The water's fine.
In order for an industry group to create value for the industry it serves, it is important to have a lot of participation by stakeholders. It is also important to make sure that stakeholder participation is not skewed to serve one (or more) stakeholder categories over others.
This brings me to OpenSG. For those not familiar with OpenSG (Open Smart Grid), it is a subcommittee created under the UCAIug (UCA International Users Group) to facilitate the creation and adoption of standards, methods, and guidelines for Smart Grid deployment. This is a utility industry group, and the intended outcome of the work being done under OpenSG is to come up with a consensus based set of standards and guidelines for all utilities deploying Smart Grid.
Under the OpenSG umbrella, there exists an SG Security Working group, and I have been involved with this group for approximately 1 1/2 years. In this time (and before I threw my hat in), there has been a lot of progress, and one can view some of the output by going to http://www.smartgridipedia.org/. One of the more notable pieces of work output is AMI Security Profile 2.0. This document was used by NIST (among other documents) to assist in the creation of the vaunted NISTIR 7628 document, and is currently being utilized by some larger utilities (such as PG&E) as a guideline for AMI security deployment.
I could go on and on about the task forces under the SG Security Working Group (such as the newly formed Embedded Security Task Force), but this is a blog posting, and keeping it short is important.
Okay, so let me tell you what concerns me. The OpenSG SG Security Working Group is quite vendor heavy, and utility light. Sure, we have great participation by some of the "big boys" (e.g. PG&E, SCE, Southern Company, Virginia Dominion, FPL), but we have nowhere near an adequate quorum of utilities participating in OpenSG. When you consider there are over 2300 investor owned utilities in the USA, as an industry group I would suggest that at least 50% (or 1150) of those utilities should be ACTIVELY involved.
Why is this important? Well, if it is not already obvious, because utilities probably have a better idea of how their industry works than the vendors do. Every stakeholder that makes up any industry group is there for one reason, and that is to discover and create opportunities for commerce, or protect their current business model and bottom line (and hopefully make it fatter). This is normal human nature in the business world, so spare the daggers.
In a vendor heavy environment, the industry group is obviously skewed in favor of the stakeholders who do not have the most at stake. Security decisions made by utilities are decisions that are going to have far reaching impact for a long time. While some may find comfort in the fact that large utilities are participating with vendors in making decisions for the industry (and regardless of participation in OpenSG the decisions made by the big boys will affect every utility), it is not wise to assume that what is good for the big utilities is good for the little guys as well. There is a SIGNIFICANT difference between the security management and deployment capabilities of a utility with 5000 employees and one with 20 employees (or even less). If vendors and large utilities decide on something like (as an example) a utility managed PKI system for key management, and products are designed to work with such a system, then a small utility may be a bit hampered in their ability to comfortably deploy.
I am not saying that the SG Security Working Group is not cognizant of this. We certainly are and discuss it regularly. However, without DIRECT input from the ACTUAL stakeholder organizations, we are forced to make educated guesses, and rely on extrapolation and conjecture in our decision making process.
Utilities who are preparing to deploy Smart Grid technologies have lots of questions and more than a few concerns about security. There are a lot of very brilliant people working in OpenSG that are happy to freely share a wealth of information about Smart Grid security, and we can all learn from more participation. We are still at an embryonic state with respect to Smart Grid security, so a little participation is sure to gain anyone who participates a lot of expertise over a short period of time.
Come on in. The water's fine.
Sunday, March 27, 2011
The Limitations Of Voluntary Efforts
James Lewis of the Center for Strategic and International Studies (CSIS) is one of my favorite figures in the world of cybersecurity. I would venture that both Mr. Lewis and the very wise Michael Assante truly get at the heart of the issues we face in the world of cybersecurity like no others. They do not cover everything, but the issues they do discuss are profound in nature.
Both Mr. Lewis and Mr. Assante like to use analogies as part of their discussions, and I like that as well. Michael Assante co-wrote a great piece on Roman Aqueducts with current NERC CSO Mark Weatherford (Assante is the former CSO), where they use analogies to compare Roman Aqueducts to the Smart Grid. I do not want to go into detail about the article, so make sure you read it. I can assure you it is quite well done.
James Lewis likes to keep things a bit closer to home, and uses a somewhat Socratic method to stimulate critical thinking. This is extremely evident in a recent testimony to the House Committee on Homeland Security. In his testimony, Mr. Lewis makes a number of absolutely wonderful points, but the part that resounded with me was the following:
"There is no other area of national security were we rely on voluntary action reinforced by incentives. A policy of voluntary efforts for better cybersecurity reinforced by incentives is not a serious effort to protect national security against real damage and a growing threat. These proposals are best seen as intended to block reform rather than to promote cybersecurity."
In order to understand this, we need a little background. Nearly all progress being made on cybersecurity in the USA is due to voluntary efforts. I personally volunteer my time to participate in NIST, OpenSG, and DHS working groups to address cybersecurity for the Smart Grid, as well as additional work I do for California for health care security. This is not an altruistic endeavor. My incentive to do so is either because I am paid to do so by a client, or because I want to develop a skill and become a subject matter expert for the purpose of exploring opportunities for commerce. This works out well in my case, because my efforts have helped me pay my bills. I am not getting rich doing this, but I am also not eating ramen noodles for dinner every night.
As it turns out, I am not alone. There are literally hundreds (if not thousands) of people volunteering their efforts to the cause for the same exact reasons. Of those, about 5% to 10% regularly contribute something besides attending a meeting or a conference call. There is some progress being made, but it is slow, and most of it has no teeth whatsoever. Why is that? Because nobody is in charge, and since there is no consideration for efforts, there is nothing anyone in charge could do anyway.
Don't misinterpret what I am saying here. I do not believe voluntary efforts are a bad thing. Heck! Our US Voluntary Militia of the 1700's did a fine job whooping some butt back in the day. Yet one has to understand that once the threat turned into a battle, it was no longer a good idea to sit around and hope that the local blacksmith was going to show up for an attack against the Redcoats.
What our Congress seems to not "get" is that we are currently fighting a daily battle against the bad guys, and the bad guys are winning. We are not fighting a war in the "classic" sense, but we are definitely getting our butts kicked more often than we would like to admit it. It leads one to question just what does Congress and our President use as a determining factor for pouring money into a national security effort. In fact, I wonder if national security really has anything to do with it at all. When we light up skies overseas with bombs, and take down villages on the ground, are we doing this to protect anything, or are we simply trying to show the world that we still have plenty of firepower to go around? Are we protecting our interests, or are we trying to get the President re-elected, or is a member of Congress trying to get re-elected, or more campaign contributions, or whatever?
Of course it could simply be that Congress and Mr. President simply do not feel the battle, because most of what goes on in the world of cyber attacks is not broadcast on the nightly news, and even if it was it is not likely to have the impact of bombs dropping and villagers screaming with blood running from their temples. It could also be tradition. Our Congress is all about tradition in many ways, and one of them is the long tradition of spending a lot of money overseas fighting battles, and NOT fighting domestic cybercrime. Sure, there have been some token payments, but nothing approaching the billion dollars per day we are now spending fighting wars overseas.
At my last Smart Grid Security Conference I had two people from state public utility commissions as speakers. Bill Hunteman from the US Department of Energy (a great and intelligent person, by the way) told me he was pleased to see that the PUC's were willing to send them to events such as mine where they can interact with others and discuss cybersecurity issues. When I told Mr. Hunteman that the only reason they came was because I paid for their travel expenses, he was surprised to hear that state PUC's had no budget for such events. This is particularly alarming when you consider that state PUC's are tasked with making decisions about cybersecurity for all of the distribution and "user" portion of the Smart Grid (i.e. Smart Meters, Advanced Metering Infrastructure, Home Area Networking), and nobody at the Federal level has any authority over this.
Think about this for a moment. We have 50 states with public utility commissions who have little or no budget allocated for cybersecurity expertise being tasked to come up with rules for Smart Grid cybersecurity. That is perhaps as effective as gong to your state Department of Motor vehicles and asking them to come up with some rules for earthquake proofing bridges...in their spare time, with no budget for hiring bridge experts.
So hopefully, once we are done starting new wars with countries, and have wrapped up some of the other wars we are fighting, our government will consider funding some of the efforts to deal with our coming cyberwar, because once the daily battles turn into a full blown war, we are not going to be ready for it.
Not at this rate.
Both Mr. Lewis and Mr. Assante like to use analogies as part of their discussions, and I like that as well. Michael Assante co-wrote a great piece on Roman Aqueducts with current NERC CSO Mark Weatherford (Assante is the former CSO), where they use analogies to compare Roman Aqueducts to the Smart Grid. I do not want to go into detail about the article, so make sure you read it. I can assure you it is quite well done.
James Lewis likes to keep things a bit closer to home, and uses a somewhat Socratic method to stimulate critical thinking. This is extremely evident in a recent testimony to the House Committee on Homeland Security. In his testimony, Mr. Lewis makes a number of absolutely wonderful points, but the part that resounded with me was the following:
"There is no other area of national security were we rely on voluntary action reinforced by incentives. A policy of voluntary efforts for better cybersecurity reinforced by incentives is not a serious effort to protect national security against real damage and a growing threat. These proposals are best seen as intended to block reform rather than to promote cybersecurity."
In order to understand this, we need a little background. Nearly all progress being made on cybersecurity in the USA is due to voluntary efforts. I personally volunteer my time to participate in NIST, OpenSG, and DHS working groups to address cybersecurity for the Smart Grid, as well as additional work I do for California for health care security. This is not an altruistic endeavor. My incentive to do so is either because I am paid to do so by a client, or because I want to develop a skill and become a subject matter expert for the purpose of exploring opportunities for commerce. This works out well in my case, because my efforts have helped me pay my bills. I am not getting rich doing this, but I am also not eating ramen noodles for dinner every night.
As it turns out, I am not alone. There are literally hundreds (if not thousands) of people volunteering their efforts to the cause for the same exact reasons. Of those, about 5% to 10% regularly contribute something besides attending a meeting or a conference call. There is some progress being made, but it is slow, and most of it has no teeth whatsoever. Why is that? Because nobody is in charge, and since there is no consideration for efforts, there is nothing anyone in charge could do anyway.
Don't misinterpret what I am saying here. I do not believe voluntary efforts are a bad thing. Heck! Our US Voluntary Militia of the 1700's did a fine job whooping some butt back in the day. Yet one has to understand that once the threat turned into a battle, it was no longer a good idea to sit around and hope that the local blacksmith was going to show up for an attack against the Redcoats.
What our Congress seems to not "get" is that we are currently fighting a daily battle against the bad guys, and the bad guys are winning. We are not fighting a war in the "classic" sense, but we are definitely getting our butts kicked more often than we would like to admit it. It leads one to question just what does Congress and our President use as a determining factor for pouring money into a national security effort. In fact, I wonder if national security really has anything to do with it at all. When we light up skies overseas with bombs, and take down villages on the ground, are we doing this to protect anything, or are we simply trying to show the world that we still have plenty of firepower to go around? Are we protecting our interests, or are we trying to get the President re-elected, or is a member of Congress trying to get re-elected, or more campaign contributions, or whatever?
Of course it could simply be that Congress and Mr. President simply do not feel the battle, because most of what goes on in the world of cyber attacks is not broadcast on the nightly news, and even if it was it is not likely to have the impact of bombs dropping and villagers screaming with blood running from their temples. It could also be tradition. Our Congress is all about tradition in many ways, and one of them is the long tradition of spending a lot of money overseas fighting battles, and NOT fighting domestic cybercrime. Sure, there have been some token payments, but nothing approaching the billion dollars per day we are now spending fighting wars overseas.
At my last Smart Grid Security Conference I had two people from state public utility commissions as speakers. Bill Hunteman from the US Department of Energy (a great and intelligent person, by the way) told me he was pleased to see that the PUC's were willing to send them to events such as mine where they can interact with others and discuss cybersecurity issues. When I told Mr. Hunteman that the only reason they came was because I paid for their travel expenses, he was surprised to hear that state PUC's had no budget for such events. This is particularly alarming when you consider that state PUC's are tasked with making decisions about cybersecurity for all of the distribution and "user" portion of the Smart Grid (i.e. Smart Meters, Advanced Metering Infrastructure, Home Area Networking), and nobody at the Federal level has any authority over this.
Think about this for a moment. We have 50 states with public utility commissions who have little or no budget allocated for cybersecurity expertise being tasked to come up with rules for Smart Grid cybersecurity. That is perhaps as effective as gong to your state Department of Motor vehicles and asking them to come up with some rules for earthquake proofing bridges...in their spare time, with no budget for hiring bridge experts.
So hopefully, once we are done starting new wars with countries, and have wrapped up some of the other wars we are fighting, our government will consider funding some of the efforts to deal with our coming cyberwar, because once the daily battles turn into a full blown war, we are not going to be ready for it.
Not at this rate.
Wednesday, March 23, 2011
RSA SecurID and The Smart Grid
The compromise of RSA's SecurID system is one of several security-related hot topics this week. I am still not sure how significant the compromise is (some say it is not overly significant, others claim it is a massive problem), but one thing is quite clear to me and many others I know in the security world - It is not a major surprise that their security has been compromised.
Security gets compromised. That is what happens with security. Some organizations have great track records. As I understand it RSA SecurID has a 20 year track record. Cryptography Research claims an 8 year perfect record for their CryptoFirewall product (used to protect, among other technologies, pay tv). DES and SHA1 had their days in the sun, but all good things come to an end, and the newer and (hopefully) better technologies take their place. Heck! There was a time when the Mac loving world believed that Macs were immune to security compromises. Think again!
RSA will fix whatever is broken. They are a good company with a long history of knowing what they are doing. Sure, they make mistakes along the way, but they are a good provider of security products. The fact is that a compromise helps build better security. As users of security technologies, we should EXPECT compromise at some point, and be prepared for it. I am a careful driver, who does not text as I drive, and stays within the speed limit (more or less), and I wear my seatbelt and back up out of parking spots nice and slow. Nonetheless, I am fully aware that operating my motor vehicle puts me at high risk for an automobile accident. I can avoid automobile accidents entirely only by never getting anywhere near an automotive vehicle. In the world of technology it is the same story. If I play in the cyber world I am going to face cybersecurity incidents.
That brings me to the Smart Grid, and perhaps more specifically Smart Meters (or AMI in general). Utility Commissions throughout the US (and perhaps the world) are hoping that rate cases cover AMI products that are going to be "good to go" for somewhere around 15 or 20 years. This strikes me (and others I have spoken to) as somewhat of a pipe dream. RSA SecurID is built to function as a sort of "Fort Knox" of security systems, and it lasted about 20 years. AMI products are simply not designed that way today, and it may be a while before they are. Simply put, utilities do not require that level of security and do not want to pay for it...and neither do consumers today (who will ultimately foot the bill due to recovery rules). It is more likely that AMI systems rolling out TODAY (and not 3 years ago) may remain "secure" for a maximum of 10 years.
Think about this for a minute. They are sitting on the outside of homes. There are no set requirements for security. The protocols, designs, and general security knowledge of vendors vary. This is new territory and we are in the earliest stages of deployment. We have to expect that we are not likely to get this right on the first few tries. We have to also expect that we are going to learn (and have learned) some valuable security lessons as we proceed.
This creates a bit of an issue for utility commissions and consumers, because we have to pay for replacing devices that fail to remain secure over time. As consumers, we are used to having to upgrade technology as time progresses. Who keeps a computer or cell phone for 10 years today? Okay, there are some who do, but not many. Technology simply moves too fast and a few years down the line anyone who uses technology to get things done simply accepts that in order to continue reaping the benefits of technology, upgrades are a given.
Ahhh...and that is the key! The consumer needs to experience the benefits.
I have a Smart Meter on my house and since I switched to off-peak pricing I have seen a drop in my power bill of approximately 30%. I simply do not use power very much in the middle of the day. Sure, it goes up a bit in the summer when I use my AC more, but it plummets in the winter. This is significant for me because my winter bills used to eclipse my summer bills. As a consumer, I am happy to have a Smart Meter on my house because these savings would not be possible without a Smart Meter (or so I am told). As a consumer, if I see a benefit, I will pay to play.
As a consumer I am also aware that I have not experienced any security-related issues...yet. It could be a long time before I do, but I am aware that the high tech nature of the Smart Grid opens up a gaping hole from a security perspective. That is the nature of technology. As a user of pocket computers (that is what we should be calling mobile phones and devices), I am aware of the major security holes that tag along with the technology, and also pray that bad things will not happen on the mobile device front. Nonetheless, I know that it is indeed quite likely that somewhere within the next decade an enterprising attacker will figure out a way to exploit our favorite new technologies, and we are not likely to go back to doing things the old fashioned way as a result of the compromise.
Let us accept the fact that this is the world we live in, continue working to build better security, avoid freaking out when things go wrong, and reap the benefits that inevitably come with new technologies.
We live and we learn.
Security gets compromised. That is what happens with security. Some organizations have great track records. As I understand it RSA SecurID has a 20 year track record. Cryptography Research claims an 8 year perfect record for their CryptoFirewall product (used to protect, among other technologies, pay tv). DES and SHA1 had their days in the sun, but all good things come to an end, and the newer and (hopefully) better technologies take their place. Heck! There was a time when the Mac loving world believed that Macs were immune to security compromises. Think again!
RSA will fix whatever is broken. They are a good company with a long history of knowing what they are doing. Sure, they make mistakes along the way, but they are a good provider of security products. The fact is that a compromise helps build better security. As users of security technologies, we should EXPECT compromise at some point, and be prepared for it. I am a careful driver, who does not text as I drive, and stays within the speed limit (more or less), and I wear my seatbelt and back up out of parking spots nice and slow. Nonetheless, I am fully aware that operating my motor vehicle puts me at high risk for an automobile accident. I can avoid automobile accidents entirely only by never getting anywhere near an automotive vehicle. In the world of technology it is the same story. If I play in the cyber world I am going to face cybersecurity incidents.
That brings me to the Smart Grid, and perhaps more specifically Smart Meters (or AMI in general). Utility Commissions throughout the US (and perhaps the world) are hoping that rate cases cover AMI products that are going to be "good to go" for somewhere around 15 or 20 years. This strikes me (and others I have spoken to) as somewhat of a pipe dream. RSA SecurID is built to function as a sort of "Fort Knox" of security systems, and it lasted about 20 years. AMI products are simply not designed that way today, and it may be a while before they are. Simply put, utilities do not require that level of security and do not want to pay for it...and neither do consumers today (who will ultimately foot the bill due to recovery rules). It is more likely that AMI systems rolling out TODAY (and not 3 years ago) may remain "secure" for a maximum of 10 years.
Think about this for a minute. They are sitting on the outside of homes. There are no set requirements for security. The protocols, designs, and general security knowledge of vendors vary. This is new territory and we are in the earliest stages of deployment. We have to expect that we are not likely to get this right on the first few tries. We have to also expect that we are going to learn (and have learned) some valuable security lessons as we proceed.
This creates a bit of an issue for utility commissions and consumers, because we have to pay for replacing devices that fail to remain secure over time. As consumers, we are used to having to upgrade technology as time progresses. Who keeps a computer or cell phone for 10 years today? Okay, there are some who do, but not many. Technology simply moves too fast and a few years down the line anyone who uses technology to get things done simply accepts that in order to continue reaping the benefits of technology, upgrades are a given.
Ahhh...and that is the key! The consumer needs to experience the benefits.
I have a Smart Meter on my house and since I switched to off-peak pricing I have seen a drop in my power bill of approximately 30%. I simply do not use power very much in the middle of the day. Sure, it goes up a bit in the summer when I use my AC more, but it plummets in the winter. This is significant for me because my winter bills used to eclipse my summer bills. As a consumer, I am happy to have a Smart Meter on my house because these savings would not be possible without a Smart Meter (or so I am told). As a consumer, if I see a benefit, I will pay to play.
As a consumer I am also aware that I have not experienced any security-related issues...yet. It could be a long time before I do, but I am aware that the high tech nature of the Smart Grid opens up a gaping hole from a security perspective. That is the nature of technology. As a user of pocket computers (that is what we should be calling mobile phones and devices), I am aware of the major security holes that tag along with the technology, and also pray that bad things will not happen on the mobile device front. Nonetheless, I know that it is indeed quite likely that somewhere within the next decade an enterprising attacker will figure out a way to exploit our favorite new technologies, and we are not likely to go back to doing things the old fashioned way as a result of the compromise.
Let us accept the fact that this is the world we live in, continue working to build better security, avoid freaking out when things go wrong, and reap the benefits that inevitably come with new technologies.
We live and we learn.
Subscribe to:
Posts (Atom)