US Electric Grid Shows ‘Worrying’ Security Gaps

Utilities firms powering the US electric grid have complained of constant cyber attacks on their systems, yet many are only doing the bare minimum to shore up their security and protect the nation’s critical infrastructure, according to a report from Congress.

Representatives Edward J. Markey and Henry A. Waxman requested information in January 2013 from more than 150 organisations supplying the bulk power system and 60 percent responded.

More than a dozen reported “daily”, “constant”, or “frequent” attempts, including phishing and malware-led attacks. One was the target of approximately 10,000 attempted cyber attacks each month.

Insecure electric grid

Yet many are only complying with mandatory standards rather than going further to protect the electric grid.

The report noted NERC (North American Electric Reliability Corporation) has established both mandatory and voluntary standards to protect against Stuxnet – the malware which infected an Iranian uranium enrichment plant and caused damage to it by toying with centrifuges.

Whilst most complied with the mandatory requirements, only 21 percent of investor-owned utilities, 44 percent of municipally or cooperatively-owned utilities, and 62.5 percent of federal entities had taken the additional recommended steps.

Security experts have called on Congress to provide a federal entity to ensure the grid is protected from potential cyber attacks, but nothing has been forthcoming, the Congressmen said.

Raj Samani, CTO of McAfee in EMEA and co-author of the just-released ‘Applied Cyber Security And The Smart Grid’, said the report painted a worrying picture of the lack of cyber resiliency of such a critical sector. There are similar fears around critical infrastructure security in the UK.

“Reports that utilities are under ‘constant’ attempted cyber attacks clearly highlight the need to ensure that Critical National Infrastructure providers have implemented measures to mitigate against these risks,” Samani told TechWeekEurope.

“Information sharing between the government and the private sector – and between private sector entities themselves – can be a powerful tool to thwart cyber adversaries.

“This doesn’t mean just general facts about threats; the real-time malicious code that’s being observed in systems around the world should be shared instantly with global experts so that people and systems can act upon that information immediately.

“The private sector is embracing innovation to constantly improve resilience and challenge the industry, government, and owners of critical infrastructure.”

What do you know about Internet security? Find out with our quiz!