Building an Effective Security Program for Distributed Energy Resources and Systems. Mariana Hentea
and local governments, the private sector, and the American people. The cornerstone of America's cyberspace security strategy is and will remain a public–private partnership. The strategic objectives are to:
Prevent cyber attacks against America's critical infrastructures.
Reduce national vulnerability to cyber attacks.
Minimize damage and recovery time from cyber attacks that do occur.
Also, strategies that the United States can use for cyberspace protection are described to include the following objectives: establish a comprehensive strategy, maintain strong deterrents, strengthen public–private partnerships, avoid bureaucratic overreach, and forge an international consensus. These strategies can help policy makers make better‐informed decisions about how to properly defend the country from threats [Peritz 2010].
In the same time, it is recognized that the perimeter of information systems and networks is increasingly blurred and that, as a consequence, the management of risks and the protection measures should extend to the more global ecosystem level.
The analysis report [OECD 2012a] reveals the success of the guiding principles of [OECD 2002] to create a framework for security in an open digital world where participants reduce risk before accepting it, instead of avoiding risk by limiting interconnectivity. These guidelines have been adopted by OECD members and non‐OECD members. Responding to cybersecurity challenges has become a national policy priority in many countries. Gaps in the 2002 guidelines and new cybersecurity challenges are further analyzed in this report [OECD 2012c]. This report highlights many issues such as the following:
New national strategies to strengthen cybersecurity are pursuing a double objective: driving further economic and social prosperity by using the full potential of the Internet as a new source of growth and platform for innovation and protecting cyberspace‐reliant societies against cyber threats.
Governments are developing comprehensive approaches integrating all facets of cybersecurity into holistic frameworks covering economic, social, educational, legal, law enforcement, technical, diplomatic, military, and intelligence‐related aspects. The result is the elevation of this overall subject matter as a government policy priority and a higher degree of governmental coordination to develop strategies.
The scope of most strategies generally covers all information systems and networks, including critical information infrastructures that are not connected to the Internet.
Strategies generally lay out a narrative that varies across countries and leads to the introduction of various key objectives and concepts.
Most strategies recognize that cyberspace is largely owned and operated by the private sector and that policies should be based on public–private partnerships, which may include business, civil society, and academia. However, they place variable emphasis on this aspect.
While cybersecurity strategies share common concepts, there are still differences such as the concepts of cybersecurity and cyberspace that are not used by all countries.
Although strategies share fundamental values, some concepts are specific to some countries, such as the economic aspects of cybersecurity, the need for dynamic policies, and the emergence of sovereignty considerations.
Most strategies also stress the importance of the international dimension of cybersecurity and the need for better alliances and partnerships with like‐minded countries or allies, including capacity building of less developed countries; all countries support the establishment of stronger international mechanisms at the policy and the operational levels. In this respect, policy makers need to:
Overcome complex coordination and cooperation challenges, internally across governmental bodies and with nongovernmental stakeholders, both at the domestic and international levels
Develop and implement action plans according to their strategies in a variety of areas such as critical information infrastructure protection, research and development, skills and jobs, economic incentives, cybersecurity exercises, etc.
Although the protection of critical information infrastructures is generally included in the scope of cybersecurity strategies, the issue of cross‐border interdependencies is rarely addressed at a strategic level.
A national cybersecurity plan is not only a strategic framework for nation's approach to cybersecurity; it is also a tool to improve the security and resilience of national infrastructures and services. Although there are many – and considerably different – definitions, a cybersecurity strategy has proven to be an instrument that helps governments manage the efforts of all involved parties in order to tackle risks related to cyber issues at a national level [ENISA 2015a]. Therefore, international and regional cooperation is needed at strategic levels to include the development of contingency and response plans in advance as well as the importance of regional and international exercises.
2.6 Cybersecurity for Electrical Sector as a National Priority
The electric grid, as government and private experts describe it, is the glass jaw of American industry. Energy‐related risks to national security can broadly be categorized into physical, cyber, economic, and conflict related, though significant overlaps among these categories exist.
Cybersecurity and industry experts have expressed concern that, if not implemented securely, Smart Grid systems will be vulnerable to attacks that could result in widespread loss of electrical services essential to maintaining the national economy and security in the United States [GAO 2012]. Besides describing cyber threats to critical infrastructures, which include the electric grid, the report discusses key challenges to securing Smart Grid systems and networks.
Often, reports on cyber threats to electrical sector are published by media. A reporter describes a threat and the impacts of threat realization as follows:
If an adversary lands a knockout blow, it could black out vast areas of the continent for weeks; interrupt supplies of water, gasoline, diesel fuel and fresh food; shut down communications; and create disruptions of a scale that was only hinted at by Hurricane Sandy and the attacks of Sept. 11. [Wald 2013]
Although this scenario sounds like a piece of science fiction, the reporter is warning the public about the fragility of the electric system that is tightly integrated that a collapse in one spot, whether by error or intent, can set off a cascade of power failure.
Another warns about the electric utility industry lacking adequate protection, and a major cyber threat to critical infrastructures is from the electric utilities [Weiss 2013]. While facts and impacts are not yet encountered by the electrical sector as described in these publications, we need to understand the dangers of cyber threats including other issues. Energy technologies must be robust and resistant to these vulnerabilities.
At least we have to consider that in today's highly connected world, with an increasingly sophisticated cyber threat, it is unrealistic to assume energy delivery systems are isolated or immune from compromise [Hawk 2014]. The grid is essential for almost everything, but it is mostly controlled by investor‐owned companies or municipal or regional agencies. That expertise involves running 5 800 major power plants and 450 000 miles of high‐voltage transmission lines, monitored and controlled by a staggering mix of devices installed over decades.
Some utilities use their own antique computer protocols and are probably safe from hacking – what the industry calls security through obscurity [Hawk 2014]. Also, cybersecurity in the IT/OT systems for the Smart Grid continues to be a significant topic and has been made even more critical by the convergence of IT/OT [Meyers 2013]. This convergence has enabled an enabled a new range of consumer‐based OT, most of which is beyond the reach or control in the traditional utility. Therefore, an IT/OT‐converged approach allows utility personnel to deploy each grid modernization application project as a part of a connected whole.
Cybersecurity is a serious and ongoing security, safety, and economic challenge for the electricity sector. The critical