Smart grid security: Recent history demonstrates the dire need

The smart grid surrounds us these days. In the U.S. approximately 36 million smart electricity meters have been deployed since 2007. In Europe, both Italy and Sweden have each achieved complete smart meter installations. Spain is actively deploying, while the rest of Europe and Asia are all on the verge of massive deployments. Utilities in North America, Europe, and China are aggressively upgrading their distribution automation (DA) infrastructure with smart-enabled devices, including line sensors and distribution controllers enabled with communication. In a relatively poor global economy, smart grid projects shine with bright success and infrastructure renewal.

Success often makes us comfortable, even complacent about the day-to-day operation of our systems. Looking forward to even more deployment, we tend to avoid hard, worrisome questions about the long-term effects of the movement. A particular thorny question for the evolving smart grid is security. Where? How much is enough? A former utility employee recently asked me, “If we network all of the electricity meters and grid infrastructure, can someone write a computer virus and take down the entire grid?” Unfortunately, my answer was yes.

To answer these smart grid security questions, we will review two recent well-documented security breaches and a report of a security gap. These situations include a 2009 smart-meter hack in Puerto Rico; a 2012 password discovery in grid distribution equipment; and insecure storage of a private key in distribution automation equipment. For each of these attacks, we’ll examine the breach, the potential threat, and secure silicon methods that, as part of a complete security strategy, can help thwart the attacks.