Frankfurt (Germany), 6-9 June 2011 Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 COMMUNICATION & DATA SECURITY

Frankfurt (Germany), 6-9 June 2011 Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Smart Grid Evolution (Nordic view) SmartGrids Evolution Time Smart Meters for billing Distribution Automation Environmental friendly equipment AMI integration with DMS Implemented LV monitoring & control Piloting Islanding and energy storage Smart (MV) substation Integration of small scale generation Initial phase 1-3 years Islanding Integration of PHEV Energy storage Emerging phase 3-7 years Integration electric vehicles (EV) Demand Response Mature phase 7-10 years

Frankfurt (Germany), 6-9 June 2011  Cyber security is a natural part of Security / Safety, and will be treated like this.  We still need to work hard to raise the priority in everyday business, because of the new threat scenarios that are not widely understood by line managers. Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Cyber Security priority in Vattenfall

Frankfurt (Germany), 6-9 June 2011  Introduction of intelligent control and connectivity between different domains; e.g. customer, markets, service provider, operation, generation, transmission and distribution  “Partial upgrades”: Long term usage of legacy assets is a competence challenge and thus a security threat  Huge amount of devices with homogeneous technology, e.g. Smart Meters, can be affected by a single disruption by bug or cyber attack Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 New threat scenarios with Smart Grid 1

Frankfurt (Germany), 6-9 June 2011  Larger scale communication network with exploding amount of controllable objects in the network  Smart Grids mean less investment to copper and more to intelligence in the grid. We are operating closer to maximum performance, so we are more vulnerable to “copper failures” Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 New threat scenarios with Smart Grid 2

Frankfurt (Germany), 6-9 June 2011  Low voltage protection and control  Smart Metering infrastructure (compliance / certification of the meters / communication)  Large scale wind power connectivity and controllability  Smart Grid security should not be thought just from technical perspective. We need to analyze and plan it at least from IT, customer, society and personal integrity perspectives Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Critical technologies of a Smart Grid need special consideration

Frankfurt (Germany), 6-9 June 2011  We use more and more wireless communication  In-house access to Smart Meters and single remote components in the network is (or will soon be) connected wirelessly.  There are plenty of bus and hardwired solutions in a substation that will remain wired in near future.  Wireless will not replace physical connections 100%, but will be used increasingly, thus specific care in compliance is needed. Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Wireless or Wired communication?

Frankfurt (Germany), 6-9 June 2011  With the increasing cost pressure from regulators, it is seldom possible to build private physical networks, unless the fiber communication infrastructure is already built  Utilizing the public networks in a secure way is often a key to success in a cost balanced way Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Public networks

Frankfurt (Germany), 6-9 June 2011  Use of insecure legacy devices  Larger scale communication network  Increasing technical complexity  "Security by obscurity" security culture background  Few aligned common standards  Interconnected networks can introduce common vulnerabilities Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Risks of the new communication technologies 1

Frankfurt (Germany), 6-9 June 2011  Lacking physical access restriction to, for example, field devices, meters, etc.  Exposure of critical infrastructure due to connectivity reasons  Introduction of new technologies and protocols  Exposure of sensitive customer data  Huge amount of devices with homogeneous technology, e.g. Smart Meters, which could be affected by a single disruption  Higher complexity due to greater interconnectivity even to non- trusted partners Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Risks of the new communication technologies 2

Frankfurt (Germany), 6-9 June 2011  Active participation in standards development  Clear roadmap of replacing legacy devices / transparency  Compliance to privacy and integrity requirements in the different legal environments  Awareness  Cooperation with different vendors to identify and implement security measures in new technology  In general transparency and control (knowing what is out there) Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Mitigation strategies

Frankfurt (Germany), 6-9 June 2011  Low hanging fruits Zone model: separation and defense in depth principle Organizational responsibility, awareness Business continuity planning Concentrate on risk mitigation, not only intrusion prevention  Harder to implement, but needed Standardization: Security in protocols (authentication, encryption), hardening, etc. Finding “good enough”, cost efficient solution, i.e. taking the business needs and restrictions into account Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Implementation

Frankfurt (Germany), 6-9 June 2011 Iiro Rinta-Jouppi – Sweden – RT 3c – Paper 0210 Questions?