Electric grid security standard creates opportunity and confusion
20 July, 2015
category: Corporate, Government
New security standards for securing the grid provide opportunities for vendors, but according to some industry advisers, that’s only if they can make sense of the specification.
Security and regulatory adviser Patrick Miller voiced his concerns that the new Critical Infrastructure Protection (CIP) standards by the Federal Energy Regulatory Commission are somewhat unclear and might actually complicate the process of securing the grid. As a result, inconsistencies are likely in how the standards are applied.
“I think they’re a mess. They made things a lot more difficult. There are a lot of unanswered questions and a lot of utilities trying to get things done the right way, and they’re probably going to miss the mark,” says Miller, managing partner at consulting firm Archer Energy Solutions. He has seen CIP regulations from all angles, having previously served as an author, implementer and federal auditor for past utility standards.
Sal D’Agostino, identity consultant and CEO of IDmachines, says that while the new standards will yield market prospects for physical security vendors, those opportunities could vary greatly from one utility to the next. “How utilities address security is very different from place to place,” he says.
FERC issued its CIP-014 standards in direct response to an April 2013 attack on the Metcalf electric substation in San Jose, Calif., where unknown gunmen fired more than 100 rounds into electricity infrastructure equipment owned and operated by Pacific Gas and Electric. Although the grid never lost power, the attack resulted in hundreds of thousands of dollars in damage, and no suspects were ever identified.
In March 2014, FERC ordered the North American Electric Reliability Corp. (NERC) to establish CIP standards governing the 500 most critical substations in the electric sector. NERC filed its proposal in May 2014, final rules were published in November and it became effective in January 2015. Electric utilities are now actively developing and implementing their physical security plans.
The standard serves as a blueprint to help utilities and security professionals understand what’s required to protect grid assets. As a result, utility owners and operators are looking at new technology to safeguard substations. This can include things like live video surveillance with intrusion-deterrent technologies, access card systems and security fencing.
Unintended consequences
Much like requiring travelers to remove their shoes at airport security checkpoints, new standards for physically securing the electrical grid could prove to be another impulsive response to terrorist threats, Miller fears. He questions whether such standards can realistically prevent an attack in common scenarios.
“My personal opinion is they’re going to spend $1-2 million hardening a substation, and then a guy with a $200 deer stand is going to circumvent that with a rifle,” says Miller. “We’re looking at a knee-jerk reaction to something that frankly is extremely hard to stop.”
They’re going to spend $1-2 million hardening a substation, and then a guy with a $200 deer stand is going to circumvent that with a rifle
Some requirements of the standard could even put the grid itself at risk. “It juxtaposes physical protections against engineering needs,” Miller says.
For instance, placing a concrete barrier around transformers to shield them could be dangerous because transformers need to have space around them to cool off. Not having sufficient space could blow the grid. Miller says this is the reason this type of shielding hasn’t been put in place in the past.
Some of the standard’s recommendations could work for the construction of new substations. The bigger problem, Miller says, is with retrofitting existing substations. “We could design a transformer in a way that it could get cooled appropriately,” he says. “But as an afterthought, that gets very hard to do. And it gets very expensive.”
While the new standard includes more of the grid’s assets, Miller says it doesn’t say much about what’s required to protect those assets.
“There are a lot of details that are frankly just very unclear,” he says. A positive is that it creates a shared lexicon for dialogue about securing the grid, Miller says. “We can have a common discussion, and that really does help,” he says.
