How Secure Is Our Power Grid? Rob Michel – March 2016

What is the Electric Grid? Power Plants, Transmission, Distribution, Substations, Switches, etc… 3 Major Power Grids Eastern , Western, Texas or ERCOT 7200 Plants over 450,000 miles of line in US Sources: Coal, Nuclear, Gas, Oil, Hydro, Wind, Solar, Etc…

Challenges Facing the Grid Today Siting new transmission lines (getting approval of new routes and obtaining rights to the necessary land) Determining an equitable approach for recovering the construction costs of a transmission line being built in one state when the new line provides benefits to out-of-state customers Ensuring that the network of long-distance transmission lines reaches renewable energy generation sites where high-quality wind and solar resources are located, which are often far from areas where electricity demand is concentrated Addressing the uncertainty in federal regulations regarding who is responsible for paying for new transmission lines; this uncertainty affects the private sector's ability to raise money to build transmission lines Protecting the grid from physical and cybersecurity attacks *Source US Energy Information Administration

What is the Future of the Electric Grid? *SMART GRID TECHNOLOGY* Incorporates digital technology into the traditional electrical system, which enables utilities and customers to receive information from and communicate with the grid. Examples: Meters, Switches, Thermostats

Electric Smart Grid

Smart Grid BENEFITS RISKS Increased Reliability Efficiency Customer Control Makes Renewables Feasible Privacy Exposure Security Breaches Easily Spread Malware Numerous Entry Points

Recent Cyber-Attacks BlackEnergy 3 Appeared 2007 as DDoS Spear-Phishing emails – Microsoft Office -Macros Infects Industrial Control Systems (ICS) and has a data wiping component December 2015 Ukraine 700,000 homes (linked to Russia nation sponsored)

Recent Cyber-Attacks Stuxnet First released 2008 Spread with infected USB flash drives to air-gapped machines Used the contractors computers to infiltrate plant Siemens SIMATIC WinCC/Step 7 controller software 2009 Iranian Bushelr nuclear power plant (US or Israel)

Stuxnet “Stuxnet has two ways to update itself. It checks back to two control servers, one in Malaysia and the other in Denmark, but also uses a peer-to-peer update system: When two Stuxnet infections encounter each other, they compare versions and make sure they both have the most recent one. It also has a kill date of June 24, 2012. On that date, the worm will stop spreading and delete itself.” Estimated 8-10 people 6 months to write Source: Bruce Schneir – Forbes Oct. 2010

What is currently being done? Budget over 83 million in Grid Security 2016 Building more Transmission Redundancy US government developed: Roadmap to Achieve Energy Delivery Systems Cybersecurity Decentralize the electric grid communications