NIST readies Smart Grid security architecture

A cybersecurity working group developing a security architecture for the Smart Grid expects to issue a preliminary report for public comment soon, outlining how security requirements will be incorporated into the design of the nation’s next-generation power distribution system.

Related story:

 First draft of a framework for building a Smart Grid unveiled

The security plan is a critical part of the Smart Grid interoperability effort being spearheaded by the National Institute of Standards and Technology (NIST). The draft document, NIST Interagency Report 7628, "Smart Grid Cyber Security Strategy and Requirements," could be released as early as today and will be available online.

It is being developed in conjunction with the Smart Grid interoperability framework, a first draft of which was released yesterday by NIST. Annabelle Lee, senior cybersecurity strategist at NIST’s Computer Security Division, said Thursday that the security document, which will include a comprehensive set of security requirements, is expected to be finalized by March.

The Smart Grid program was established in the Energy Independence and Security Act of 2007, which mandated that security be built into the system that would use intelligent networking and automation to better control the flow and delivery of electricity to consumers. This would require a two-way flow of electricity and information between the power plant and the end user, and to points in between.

“History has shown that you can’t add security later” to complex systems, said George Arnold, NIST deputy director of technical services, who is leading the effort to define Smart Grid interoperability standards. “We’re putting the security architecture and requirements up front.”

“This is very different for us,” said Lee. The Computer Security Division traditionally has been called upon to develop security standards and requirements for systems that already have been deployed.

Developing a security architecture in parallel with the system design and engineering processes is a challenge, because the overall architecture of the system has not yet been determined. But it is necessary to conduct the different processes at the same time because development and even deployment of some elements of the Smart Grid already are under way.

“The urgent need for this framework was vastly accelerated with the passing of the recovery act,” which provides millions of dollars to jump-start development of Smart Grid technology, said NIST Deputy Director Pat Gallagher (who has been nominated by President Barack Obama to become director of NIST).

The interoperability framework for the Smart Grid is expected to be finalized by mid-November and is the first of a three-phase program to develop interoperability standards. In the second phase, an interoperability panel will begin meetings on Nov. 16 to assist development of remaining technical standards needed to ensure interoperability. This work is expected to be completed next year. The third phase is development of an interoperability testing and certification program. Gallagher called the timetable aggressive, but realistic.

Deployment of a Smart Grid offers a greenfield opportunity because the existing grid, parts of which are 50 years old or older, was not designed to support alternative energy sources such as wind and solar power, and the two-way flow of energy and data. But this wholesale upgrade also makes it imperative that security be built in now, because the grid lifecycle is measured in decades rather than years, as it is for much of the rest of our information infrastructure. Equipment being designed for deployment now might not be replaced for decades.

Smart Grid security requirements will be developed for specific domains, business and mission functions and interfaces, as well as for the overall grid. But they are being developed at a high level and will not be spelled out for specific systems or components because of the impossible complexity of that job.

The security requirements and architecture will address not only deliberate attacks, but errors, failures and natural disasters that also could destabilize the grid. Smart Grid risks being addressed by the working group include:

  • Increasing complexity, which could introduce vulnerabilities and increase exposure to attacks and errors;
  • Interconnected networks, which could introduce common vulnerabilities;
  • Increasing vulnerability to disruption of communications and the introduction of malicious code;
  • Increased number of entry points for exploits; and
  • The potential for loss of confidentiality, including breach of customer privacy.

The security architecture being developed will identify interfaces between functional domains of the new grid and categorize them according to the criticality of their data accuracy and availability. The constraints, issues and impacts of breaches at these interfaces will be considered for each category, and security requirements will be developed.

The next steps in developing the security plan will be to assess existing standards that could apply to security requirements, to identify gaps where adequate standards do not now exist, and to assess development of new standards to address those gaps.

About the Author

William Jackson is freelance writer and the author of the CyberEye blog.

The 2015 Federal 100

Meet 100 women and men who are doing great things in federal IT.


  • Shutterstock image (by venimo): e-learning concept image, digital content and online webinar icons.

    Can MOOCs make the grade for federal training?

    Massive open online courses can offer specialized IT instruction on a flexible schedule and on the cheap. That may not always mesh with government's preference for structure and certification, however.

  • Shutterstock image (by edel): graduation cap and diploma.

    Cybersecurity: 6 schools with the right stuff

    The federal government craves more cybersecurity professionals. These six schools are helping meet that demand.

  • Rick Holgate

    Holgate to depart ATF

    Former ACT president will take a job with Gartner, follow his spouse to Vienna, Austria.

  • Are VA techies slacking off on Yammer?

    A new IG report cites security and productivity concerns associated with employees' use of the popular online collaboration tool.

  • Shutterstock image: digital fingerprint, cyber crime.

    Exclusive: The OPM breach details you haven't seen

    An official timeline of the Office of Personnel Management breach obtained by FCW pinpoints the hackers’ calibrated extraction of data, and the government's step-by-step response.

  • Stephen Warren

    Deputy CIO Warren exits VA

    The onetime acting CIO at Veterans Affairs will be taking over CIO duties at the Office of the Comptroller of the Currency.

  • Shutterstock image: monitoring factors of healthcare.

    DOD awards massive health records contract

    Leidos, Accenture and Cerner pull off an unexpected win of the multi-billion-dollar Defense Healthcare Management System Modernization contract, beating out the presumptive health-records leader.

  • Sweating the OPM data breach -- Illustration by Dragutin Cvijanovic

    Sweating the stolen data

    Millions of background-check records were compromised, OPM now says. Here's the jaw-dropping range of personal data that was exposed.

  • FCW magazine

    Let's talk about Alliant 2

    The General Services Administration is going to great lengths to gather feedback on its IT services GWAC. Will it make for a better acquisition vehicle?

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above