recommended reading

Industry Needs to Step Up to Protect the Power Grid From Cyber Attack


Energy companies should create a new industry-led body to deflect cyber threats to the electric grid -- from large generators to local distribution utilities, according to a new report co-authored by Ret. Gen. Michael Hayden, former CIA and National Security Agency director. 

Such an organization would include power companies across North America and be patterned after the nuclear industry’s Institute of Nuclear Power Operations, an entity established following the Three Mile Island accident in 1979. The paper, which was released on Friday by the nonprofit Bipartisan Policy Center, evaluates approaches to protecting the continent's electric grid from cyber attacks. 

"We believe such an organization could substantially advance cybersecurity risk-management practices across the industry," the authors write. 

The idea of a new governing body arrives at a time when critical infrastructure operators, including healthcare systems and banks, are increasingly concerned about the vulnerability of networks that would upend daily living if disrupted. 

The energy sector is somewhat ahead of the pack in reducing weaknesses because the U.S. government enforces mandatory cyber standards for the bulk power system, mainly high-voltage transmission facilities and large generators. But distribution vendors that deliver power to local customers are not part of that regulated system.

The envisioned North American body, which the authors dub the Institute for Electric Grid Cybersecurity, would oversee all the power industry players that could compromise the electric grid if hacked.  

"In some cases, cyberattacks on distribution system facilities could have consequences that extend beyond that system," the authors write. "Simultaneous attacks on multiple distribution utilities, or an attack on a single utility’s distribution operations in multiple locations, could have broader ramifications for the bulk power system."

In addition, attackers that hit one electricity sector component could imperil other interconnected vital U.S. sectors. "Electric distribution systems carry power to pipelines, water systems, telecommunications and other critical infrastructure, while also serving critical government or military facilities," according to the authors. "Distribution-level cyberattacks that disrupt electric service to such facilities could have important economic and security consequences."

The report notes that the 2003 Northeast blackout cost $6 billion. While that incident was blamed on a tree branch in Ohio, not a hack, a cyberattack combined with a kinetic attack, such as a bombing, could have the same effect. "A large-scale cyberattack or combined cyber and physical attack could potentially lead to even larger costs, triggering sustained power outages over large portions of the electric grid and prolonged disruptions in communications, food and water supplies, and healthcare delivery," the authors state. 

The new institute would not alter the two existing industry and federal entities that regulate solely the bulk power system: the North American Electric Reliability Corporation (NERC), a standards-setting organization, and the Federal Energy Regulatory Commission (FERC), the agency that enforces the standards. 

Mark Weatherford, the Homeland Security Department's former top cyber official, who previously served as chief security officer at NERC, was among the cyber, energy and national security specialists who contributed to Friday's report. 

The authors write that, "at present, we do not believe that there is a sufficient case for expanding FERC’s jurisdiction to encompass cybersecurity at the level of the distribution system.”

Participation in the institute would be optional. 

The federal government would persuade companies to join by treating "participation in the institute -- and satisfactory performance evaluations -- as equivalent to adopting the cybersecurity cramework to the extent adoption of the framework is required to be eligible for particular government programs or incentives going forward," the authors write. Earlier this month, the White House issued a voluntary framework of cyber guidelines applicable to all critical infrastructure sectors. It is expected that contractors who comply with the practices and policies will be rewarded with more government business. 

Other carrots suggested in the report include better access to insurance against economic losses caused by network breaches. Coverage initially would be guaranteed by the federal government. 

"A federal backstop would increase carriers’ willingness to offer cyber insurance and lower the cost of doing so,” the authors write. “In addition, a federal backstop would give carriers time to gather and review data about cyber incidents as they seek to develop policies that appropriately share risk."

Of the roughly 260 cyber incidents that critical infrastructure companies reported to the government last year, the majority -- 59 percent -- occurred in the energy sector, according to the DHS Industrial Control Systems Cyber Emergency Response Team.  

Threatwatch Alert

Network intrusion

Florida’s Concealed Carry Permit Holders Names Exposed

See threatwatch report


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.


When you download a report, your information may be shared with the underwriters of that document.