1. PJM©2013 Cyber Threats to the Electric Power Grid Steven McElwee October 16, 2013 www.pjm.com Copyright © 2013 by PJM Interconnection, LLC

2. PJM©2013 2 Power Grid Power Grid as a System www.pjm.com Generation Transmission Distribution Communication ISO/RTO Processes Coal Natural Gas Uranium Wind Water

3. PJM©2013 3 One Power Grid, Or Four? www.pjm.com

4. PJM©2013 4 PJM as Part of the Eastern Interconnection KEY STATISTICS Member companies 800+ Millions of people served 61 Peak load in megawatts 165,492 MWs of generating capacity183,604 Miles of transmission lines 62,556 2012 GWh of annual energy 793,679 Generation sources 1,376 Square miles of territory243,417 States served 13 + DC KEY STATISTICS Member companies 800+ Millions of people served 61 Peak load in megawatts 165,492 MWs of generating capacity183,604 Miles of transmission lines 62,556 2012 GWh of annual energy 793,679 Generation sources 1,376 Square miles of territory243,417 States served 13 + DC 21% of U.S. GDP produced in PJM As of 6/1/2013 www.pjm.com

5. PJM©2013 5 PJM ‒ Focus on Just 3 Things Market Operation Energy Capacity Ancillary Services Market Operation Energy Capacity Ancillary Services Regional Planning 15-Year Outlook Regional Planning 15-Year Outlook Reliability Grid Operations Supply/Demand Balance Transmission monitoring Reliability Grid Operations Supply/Demand Balance Transmission monitoring 2 2 1 1 3 3 www.pjm.com

6. PJM©2013 6 Air Traffic Control for the Electric Power Grid www.pjm.com

7. PJM©2013 7 1977 NY City Blackout www.pjm.com

8. PJM©2013 8 Threat at the Input – Natural Gas www.pjm.com

9. PJM©2013 9 Threat at the Output – Smart Meters www.pjm.com

10. PJM©2013 10 Threats to the Overall System www.pjm.com

11. PJM©2013 11 BHATs – Solar Flares, GIC, and EMP www.pjm.com

12. PJM©2013 12 Physical Safeguards www.pjm.com

13. PJM©2013 13 Information Security Strategic Framework Cyber Attacks R I S K T R E A T M E N T P L A N S DEFEND RESPOND PARTNER EDUCATE Metrics Measure Effectiveness Risk Assessment www.pjm.com

14. PJM©2013 14 Vulnerability Management www.pjm.com Vulnerability Assessment Security Patch Management Penetration Testing Security Assessment Committee

15. PJM©2013 15 Level 2 – Business Hours Round the Clock Security Monitoring Level 1 Level 2 – On-Call After Hours Escalation www.pjm.com

16. PJM©2013 16 Spear Phishing Campaigns www.pjm.com Baseline 20% Results 4%

17. PJM©2013 17 Cyber Risk Information Sharing Program www.pjm.com CRISP Industry Participants

18. PJM©2013 18 www.pjm.com Thank You