State of the Industry NAESB Critical Infrastructure Committee

Regulatory Changes FCC is performing smart grid, cybersecurity and critical infrastructure protection inquiries. NAESB has taken steps to achieve visibility with FCC stakeholders and to advise membership on new moves by the FCC. NIST has submitted its draft NISTIR for public comment, and FERC has now solicited comments. NERC has clearly limited jurisdiction in view of Federal Power Act 215 scope, what comes next?

Telecom Sector Interest Robert Mayer, VP Strategy at USTelecom, vice- chair Communications Sector Coordinating Council Given the deepening interdependency of the telecom and power grid, how does this increase risk to critical infrastructure? Are we making regulators aware of industry’s active efforts and the new financial and operational burdens? How can we work productively together?

Vulnerabilities Not just about smart meters anymore, it’s getting worse. “Asymmetric” warfare presentation by al-Qaeda terrorists & others (in addition to foreign gov’ts.) Existing security controls are now proven to be inadequate, may provide false sense of confidence in security posture Costs to implement solutions are not yet known

Justifications for Action Premise 1: Current federal regulators, (NERC, DOT, DOE, etc) have no real penetration and visibility into retail operations Premise 2: Interdependency with telecom sector assets provides an exponentially growing attack surface Premise 3: Failure to protect the architecture end-to-end can propagate up to and across BES, trading systems for gas and electric transactions could be compromised or altered. Premise 4: Risk of failure is higher and growing, with exposure to crippling regulation, financial ruin, and untenable public safety risk.

Solutions We need real-time intelligence on: – What current deployments look like – Where the vulnerabilities are – What attacks are occurring in real time We need support from regulators: – Immunity from liability on current vulnerabilities – Release from anti-trust and other constraints to promote collaboration – A real-time vehicle to enable secure, trusted, candid conversations and situational awareness

Discussion