1. The Voice of the Asset Owner ICSJWG – April 2011 @ Dallas  UCAIug  SG Security  ASAP-SG SG Security WG Chair: Darren Reece Highfill darren@utilisec.org

2. A Little History… Original Utility Communications Architecture – –EPRI Project RP2949 - 1991 – –Utility Data Communications from Enterprise to Customer – –Adoption limited Lack of detailed spec about how protocols would be used by apps (mapping)  Interoperability issues UCA (MMS) Forum – –Started in 1992 to address interoperability – –Genesis of utility-vendor collaborative venue Build technical agreements around interoperability  Idea of defining standard power system objects Map to services, MMS data types, other underlying protocols

3. UCA International Users Group UCA2UCA2 –Started in 1996 Published as IEEE TR1550 (1999)Published as IEEE TR1550 (1999) –Endorses ten different profiles, incl. TCP/IP, ICCP, etc. Organized data via the Generic Object Models for Substation and Feeder Equipment (GOMSFE)Organized data via the Generic Object Models for Substation and Feeder Equipment (GOMSFE) Included Common Application Service Model (CASM)Included Common Application Service Model (CASM) –Submitted to IEC (TC57 WG10) IEC 61850 released in 2003IEC 61850 released in 2003 UCA International Users GroupUCA International Users Group –Incorporated June 2002 as a 501(c)(3) Corp –Organization supports individual and corporate members from utilities, vendors, and others 134 corporate members134 corporate members Members from 29 countriesMembers from 29 countries Hundreds of “friends of the UCAIug”Hundreds of “friends of the UCAIug”

4. UCAIug Corporate Supporters

5. UCAIug Membership Composition

6. UCAIug Mission (from Charter) Enable utility integration through the deployment of open standardsEnable utility integration through the deployment of open standards Provide a forum for the various stakeholders in the utility industry to work cooperatively together as members of a common organization to:Provide a forum for the various stakeholders in the utility industry to work cooperatively together as members of a common organization to: –Influence, select, and/or endorse open and public standards appropriate to the utility market based upon the needs of the membership –Specify, develop, and/or accredit product/system testing programs that facilitate the field interoperability of products and systems based upon these standards –Implement educational and promotional activities that increase awareness and deployment of these standards in the utility industry

7. http://www.ucaiug.org/ UCAIug Organization Chart

8. 2007 OpenHAN 1.0 approved ZigBee a good choice due to industry support despite technical issues Initiates cross utility leadership discussions Identified and communicated gaps in ZigBee standard Talks initiated with HomePlug to align with ZigBee on Smart Energy. Active in defining AMI Security requirements under UCA and DOE funded projects such as ASAP Aligning utilities on common Home Area Network strategy ZigBee Smart Energy (SE) 1.0 technical issues identified with resolutions in SE 2.0 Formed joint ZigBee & HomePlug group to develop multi-medium SE 2.0 Re-birth of utility-led initiatives through UCA International Users Group Security focus broadens to other SG applications Smart Energy 2.0 release includes end to end system view, comprehensive certification process and IEC/IETF/IEEE compliance Implementing Smart Grid standards strategy Expanded scope of UCA to cover Smart Grid strategy Close working ties with NIST and DOE, etc. Too many HAN standards but none fully met requirements Lack of coordination in utility efforts Utilities would not agree to a common technical solution due to differences in regulation, topography, and technology preferences No utility alignment on SG standards OpenHAN Task Group begins work 201020092008 UCAIug OpenSG

9. SG Security Working Group ChairDarren Highfill, SCE Vice-ChairBobby Brown, EnerNex SecretaryNick Gerbino, Dominion

10. SG Security WG – Task Forces Usability Analysis Task ForceUsability Analysis Task Force –Evaluation and refinement of Security Profiles and other materials considered for ratification by the SG Security WG –Chair: John Lilley (SDG&E), Vice-Chair: Daniel Thanos (GE) CyberSec-Interop Task ForceCyberSec-Interop Task Force –Spinoff from DOE National SCADA Test Bed Lemnos Interoperable Security Project –Development of interoperable security configuration profiles –Chair: Dave Teumim (Teumim Technical), Vice-Chair: John Stewart (TVA) AMI-SEC Task ForceAMI-SEC Task Force –Produce technical specifications used by utilities to assess and procure –Determine baseline level of detail (prescriptive in nature), compliant products will have known functionality and robustness –Chair: Darren Highfill (SCE), Vice-Chair: Bobby Brown (EnerNex) Embedded Systems Security Task ForceEmbedded Systems Security Task Force –Security requirements for embedded components and devices used in utility field systems –Chair: Rohit Khera (PG&E), Vice-Chair: Daniel Thanos (GE)

11. Project Description:Project Description: –Utility-driven, public-private collaborative project to develop system-level security requirements for smart grid technology Needs Addressed:Needs Addressed: –Utilities: specification in RFP –Vendors: reference in build process –Government: assurance of infrastructure security –Commissions: protection of public interests Approach:Approach: –Architectural team  produce material –Usability Analysis team  assess effectiveness –NIST, UtiliSec  review, approve Deliverables:Deliverables: –Strategy & Guiding Principles white paper –Security Profile Blueprint –6 Security Profiles –Usability Analysis ASAP-SG: Summary Schedule: June 2009 – May 2011 Budget: $3M/year ( $1.5M Utilities + $1.5M DOE) Performers: Utilities, EnerNex, Inguardians, SEI, ORNL Partners: DOE, EPRI Release Path: NIST, UCAIug Contacts: Bobby Brown bobby@enernex.combobby@enernex.com Darren Highfill darren@utilisec.orgdarren@utilisec.org Schedule: June 2009 – May 2011 Budget: $3M/year ( $1.5M Utilities + $1.5M DOE) Performers: Utilities, EnerNex, Inguardians, SEI, ORNL Partners: DOE, EPRI Release Path: NIST, UCAIug Contacts: Bobby Brown bobby@enernex.combobby@enernex.com Darren Highfill darren@utilisec.orgdarren@utilisec.org

12. Funding & Workflow Feeding and accelerating smart grid standards developmentFeeding and accelerating smart grid standards development Model of public-private partnershipModel of public-private partnership

13. ASAP-SG Security Profiles Prescriptive, actionable guidancePrescriptive, actionable guidance –How to build-in and implement security Tailored to a set of specific smart grid functions, such asTailored to a set of specific smart grid functions, such as –Advanced Metering Infrastructure –Third Party Data Access –Distribution Management –Wide Area Management (Synchrophasors) –Home Area Networks –Substation Automation PROPOSED COMPLETE UNDERWAY

14. Security Requirements Relevant to SG

15. Questions? darren@utilisec.org SG Security WG Collaboration Site http://osgug.ucaiug.org/utilisec