The National Institute of Standards and Technology (NIST) issued its first Guidelines for Smart Grid Cyber Security.
The guidelines include high-level security requirements, a framework for assessing risks, an evaluation of privacy issues at personal residences, and additional information for businesses and organizations to use as they craft strategies to protect the modernizing power grid from attacks, malicious code, cascading errors, and other threats.
The three-volume set of guidelines is the product of two formal public reviews and the focus of numerous workshops and teleconferences over the past 17 months. It intended to facilitate organization-specific Smart Grid cyber security strategies focused on prevention, detection, response and recovery.
Cyber security spending will represent approximately 15% of total
smart grid capital investment between now and 2015, according to a recent report from Pike Research.
The NIST report was prepared by the Cyber Security Working Group (CSWG) of the Smart Grid Interoperability Panel, a public-private partnership launched by NIST with American Recovery and Reinvestment Act funding from the Department of Energy.
The guidelines are the second major output of NIST-coordinated efforts to identify and develop standards needed to convert the nation’s aging electric grid into an advanced, digital infrastructure with two-way capabilities for communicating information, controlling equipment and distributing energy.
Produced by the 450-member working group, with participants from academia and both the public and private sectors, the new guidelines elaborate on the cyber security overview in the group’s first major output, the January 2010 NIST Framework and Roadmap for Smart Grid Interoperability Standards, Release 1.0.
"These advisory guidelines are a starting point for the sustained national effort that will be required to build a safe, secure and reliable Smart Grid," said George Arnold, NIST’s national coordinator for Smart Grid interoperability. "They provide a technical foundation for utilities, hardware and software manufacturers, energy management service providers, and others to build upon. Each organization’s implementation of cyber security requirements should evolve as technology advances and new threats to grid security arise."
The report advocates a layered–or "defense in depth"–approach to security. Because cyber security threats are diverse and evolving, the report recommends implementing multiple levels of security.
The guidelines identify 137 interfaces–points of data exchange or other types of interactions within or between different Smart Grid systems and subsystems. These are assigned to one or more of 22 categories on the basis of shared or similar functional and security characteristics. In all, the report details 189 high-level security requirements applicable either to the entire Smart Grid or to particular parts of the grid and associated interface categories.
All three volumes of Guidelines for Smart Grid Cyber Security (NISTIR 7628) can be downloaded at the link below.
Loading...