recommended reading

Industry Needs to Step Up to Protect the Power Grid From Cyber Attack


Energy companies should create a new industry-led body to deflect cyber threats to the electric grid -- from large generators to local distribution utilities, according to a new report co-authored by Ret. Gen. Michael Hayden, former CIA and National Security Agency director. 

Such an organization would include power companies across North America and be patterned after the nuclear industry’s Institute of Nuclear Power Operations, an entity established following the Three Mile Island accident in 1979. The paper, which was released on Friday by the nonprofit Bipartisan Policy Center, evaluates approaches to protecting the continent's electric grid from cyber attacks. 

"We believe such an organization could substantially advance cybersecurity risk-management practices across the industry," the authors write. 

The idea of a new governing body arrives at a time when critical infrastructure operators, including healthcare systems and banks, are increasingly concerned about the vulnerability of networks that would upend daily living if disrupted. 

The energy sector is somewhat ahead of the pack in reducing weaknesses because the U.S. government enforces mandatory cyber standards for the bulk power system, mainly high-voltage transmission facilities and large generators. But distribution vendors that deliver power to local customers are not part of that regulated system.

The envisioned North American body, which the authors dub the Institute for Electric Grid Cybersecurity, would oversee all the power industry players that could compromise the electric grid if hacked.  

"In some cases, cyberattacks on distribution system facilities could have consequences that extend beyond that system," the authors write. "Simultaneous attacks on multiple distribution utilities, or an attack on a single utility’s distribution operations in multiple locations, could have broader ramifications for the bulk power system."

In addition, attackers that hit one electricity sector component could imperil other interconnected vital U.S. sectors. "Electric distribution systems carry power to pipelines, water systems, telecommunications and other critical infrastructure, while also serving critical government or military facilities," according to the authors. "Distribution-level cyberattacks that disrupt electric service to such facilities could have important economic and security consequences."

The report notes that the 2003 Northeast blackout cost $6 billion. While that incident was blamed on a tree branch in Ohio, not a hack, a cyberattack combined with a kinetic attack, such as a bombing, could have the same effect. "A large-scale cyberattack or combined cyber and physical attack could potentially lead to even larger costs, triggering sustained power outages over large portions of the electric grid and prolonged disruptions in communications, food and water supplies, and healthcare delivery," the authors state. 

The new institute would not alter the two existing industry and federal entities that regulate solely the bulk power system: the North American Electric Reliability Corporation (NERC), a standards-setting organization, and the Federal Energy Regulatory Commission (FERC), the agency that enforces the standards. 

Mark Weatherford, the Homeland Security Department's former top cyber official, who previously served as chief security officer at NERC, was among the cyber, energy and national security specialists who contributed to Friday's report. 

The authors write that, "at present, we do not believe that there is a sufficient case for expanding FERC’s jurisdiction to encompass cybersecurity at the level of the distribution system.”

Participation in the institute would be optional. 

The federal government would persuade companies to join by treating "participation in the institute -- and satisfactory performance evaluations -- as equivalent to adopting the cybersecurity cramework to the extent adoption of the framework is required to be eligible for particular government programs or incentives going forward," the authors write. Earlier this month, the White House issued a voluntary framework of cyber guidelines applicable to all critical infrastructure sectors. It is expected that contractors who comply with the practices and policies will be rewarded with more government business. 

Other carrots suggested in the report include better access to insurance against economic losses caused by network breaches. Coverage initially would be guaranteed by the federal government. 

"A federal backstop would increase carriers’ willingness to offer cyber insurance and lower the cost of doing so,” the authors write. “In addition, a federal backstop would give carriers time to gather and review data about cyber incidents as they seek to develop policies that appropriately share risk."

Of the roughly 260 cyber incidents that critical infrastructure companies reported to the government last year, the majority -- 59 percent -- occurred in the energy sector, according to the DHS Industrial Control Systems Cyber Emergency Response Team.  

Threatwatch Alert

Credential-stealing malware / User accounts compromised / Software vulnerability

Android Malware Infects More than 1M Phones, Adds 13,000 Devices a Day

See threatwatch report


Close [ x ] More from Nextgov

Thank you for subscribing to newsletters from
We think these reports might interest you:

  • Featured Content from RSA Conference: Dissed by NIST

    Learn more about the latest draft of the U.S. National Institute of Standards and Technology guidance document on authentication and lifecycle management.

  • PIV- I And Multifactor Authentication: The Best Defense for Federal Government Contractors

    This white paper explores NIST SP 800-171 and why compliance is critical to federal government contractors, especially those that work with the Department of Defense, as well as how leveraging PIV-I credentialing with multifactor authentication can be used as a defense against cyberattacks

  • Toward A More Innovative Government

    This research study aims to understand how state and local leaders regard their agency’s innovation efforts and what they are doing to overcome the challenges they face in successfully implementing these efforts.

  • From Volume to Value: UK’s NHS Digital Provides U.S. Healthcare Agencies A Roadmap For Value-Based Payment Models

    The U.S. healthcare industry is rapidly moving away from traditional fee-for-service models and towards value-based purchasing that reimburses physicians for quality of care in place of frequency of care.

  • GBC Flash Poll: Is Your Agency Safe?

    Federal leaders weigh in on the state of information security

  • Data-Centric Security vs. Database-Level Security

    Database-level encryption had its origins in the 1990s and early 2000s in response to very basic risks which largely revolved around the theft of servers, backup tapes and other physical-layer assets. As noted in Verizon’s 2014, Data Breach Investigations Report (DBIR)1, threats today are far more advanced and dangerous.


When you download a report, your information may be shared with the underwriters of that document.