Blinkered 'Smart Grid' Security Responses

A colleague pointed me to a CNN headlined news story this morning titled ‘Smart Grid’ may be vulnerable to hackers.

It’s an interesting piece largely focused upon several implied risks associated with the “smart” part of the new grid proposals – i.e. the interconnected nature of the newer devices. There are of course the usual smatterings of sensationalist “hackers can break this”.

I’ve been involved in several aspects of Smart Grid security for some time now – ranging from embedding security in to the smart meters themselves through to penetration testing of national power grids and nuclear plants. And yes, while it’s true that there are ways of breaching most of the technologies out there (and several of the technologies that are still only a twinkling in the eyes of an engineer), this applies to any technology – past, present and future.

Without getting in to the nitty-gritty of particular technologies and their respective security flaws, I think many people underestimate the advances that have been made in overall system security as we progress towards a Smart Grid infrastructure. Sure, for many the use of wireless communication technologies in household power meters raises the specter of past security failings in technologies such as 802.11b WEP – but a lot has been learnt in the meantime. Just as many security consultants will point to old security flaws, and actively look for them in newer technologies, the engineers developing these new smart grid solutions aren’t ignorant of the past either.

Yes there are going to be security flaws. I know firsthand of several such flaws, and I can point out several new vectors for attack that power distribution systems haven’t had to worry about in the past. However, proposals to not pursue this newer and vastly more efficient Smart Grid technology for fear of security flaws – in my opinion – are pointless. The older systems already have more severe vulnerabilities, (which are known to a greater number of people) and many of the technology advances within Smart Grid are designed to remedy them.

I’ve heard many times that a hacker could break in to a home’s wireless power meter and do all kinds of nastyness (and in some cases it’s probably true – with enough time and effort). That’s as maybe - but why bother? Today (and for the last 50+ years) you can do much more damage and conduct all kinds of fraud with a $2 pair of wire cutters.

I’ve also heard that someone could hack in to a nuclear power plant and shut it down, which would affect millions of houses and businesses in the country. Frankly you could cause much of the same wide scale disruption by simply crashing a couple of rental cars into two power distribution centers simultaneously - which could cause a widespread cascading power failure. Or, on a more provincial level, simply throwing a bicycle over the fence of a local distribution center and on to the pylons will be enough to interrupt power to thousands of local houses and businesses. Which particular threat are you trying to protect against?

There are thousands of security aspects to Smart Grid, and there are going to be security flaws - but we're going to be in a much better position to mitigate them. Unfortunately we (speaking on behalf of those of us in the security business) often spend a disproportionate amount of time picking holes in future and proposed technologies rather than properly acknowledging the security flaws already present within today’s deployed systems. In a perfect world we could take a time out before advancing to a new technology – making sure it was perfect before implementation. Sorry, but nothings perfect, and you can’t guarantee anything will be secure from a motivated attacker with time on their hands.

I've seen a lot of this "sky is falling" rhetoric recently. I'd rather we compared the state/security of the present/past power system with the proposed state/security of the replacement Smart Grid solutions.