NIST readies Smart Grid security architecture

A cybersecurity working group developing a security architecture for the Smart Grid expects to issue a preliminary report for public comment soon, outlining how security requirements will be incorporated into the design of the nation’s next-generation power distribution system.

Related story:

 First draft of a framework for building a Smart Grid unveiled

The security plan is a critical part of the Smart Grid interoperability effort being spearheaded by the National Institute of Standards and Technology (NIST). The draft document, NIST Interagency Report 7628, "Smart Grid Cyber Security Strategy and Requirements," could be released as early as today and will be available online.

It is being developed in conjunction with the Smart Grid interoperability framework, a first draft of which was released yesterday by NIST. Annabelle Lee, senior cybersecurity strategist at NIST’s Computer Security Division, said Thursday that the security document, which will include a comprehensive set of security requirements, is expected to be finalized by March.

The Smart Grid program was established in the Energy Independence and Security Act of 2007, which mandated that security be built into the system that would use intelligent networking and automation to better control the flow and delivery of electricity to consumers. This would require a two-way flow of electricity and information between the power plant and the end user, and to points in between.

“History has shown that you can’t add security later” to complex systems, said George Arnold, NIST deputy director of technical services, who is leading the effort to define Smart Grid interoperability standards. “We’re putting the security architecture and requirements up front.”

“This is very different for us,” said Lee. The Computer Security Division traditionally has been called upon to develop security standards and requirements for systems that already have been deployed.

Developing a security architecture in parallel with the system design and engineering processes is a challenge, because the overall architecture of the system has not yet been determined. But it is necessary to conduct the different processes at the same time because development and even deployment of some elements of the Smart Grid already are under way.

“The urgent need for this framework was vastly accelerated with the passing of the recovery act,” which provides millions of dollars to jump-start development of Smart Grid technology, said NIST Deputy Director Pat Gallagher (who has been nominated by President Barack Obama to become director of NIST).

The interoperability framework for the Smart Grid is expected to be finalized by mid-November and is the first of a three-phase program to develop interoperability standards. In the second phase, an interoperability panel will begin meetings on Nov. 16 to assist development of remaining technical standards needed to ensure interoperability. This work is expected to be completed next year. The third phase is development of an interoperability testing and certification program. Gallagher called the timetable aggressive, but realistic.

Deployment of a Smart Grid offers a greenfield opportunity because the existing grid, parts of which are 50 years old or older, was not designed to support alternative energy sources such as wind and solar power, and the two-way flow of energy and data. But this wholesale upgrade also makes it imperative that security be built in now, because the grid lifecycle is measured in decades rather than years, as it is for much of the rest of our information infrastructure. Equipment being designed for deployment now might not be replaced for decades.

Smart Grid security requirements will be developed for specific domains, business and mission functions and interfaces, as well as for the overall grid. But they are being developed at a high level and will not be spelled out for specific systems or components because of the impossible complexity of that job.

The security requirements and architecture will address not only deliberate attacks, but errors, failures and natural disasters that also could destabilize the grid. Smart Grid risks being addressed by the working group include:

  • Increasing complexity, which could introduce vulnerabilities and increase exposure to attacks and errors;
  • Interconnected networks, which could introduce common vulnerabilities;
  • Increasing vulnerability to disruption of communications and the introduction of malicious code;
  • Increased number of entry points for exploits; and
  • The potential for loss of confidentiality, including breach of customer privacy.

The security architecture being developed will identify interfaces between functional domains of the new grid and categorize them according to the criticality of their data accuracy and availability. The constraints, issues and impacts of breaches at these interfaces will be considered for each category, and security requirements will be developed.

The next steps in developing the security plan will be to assess existing standards that could apply to security requirements, to identify gaps where adequate standards do not now exist, and to assess development of new standards to address those gaps.

About the Author

William Jackson is a Maryland-based freelance writer.

The Fed 100

Read the profiles of all this year's winners.


  • Then-presidential candidate Donald Trump at a 2016 campaign event. Image: Shutterstock

    'Buy American' order puts procurement in the spotlight

    Some IT contractors are worried that the "buy American" executive order from President Trump could squeeze key innovators out of the market.

  • OMB chief Mick Mulvaney, shown here in as a member of Congress in 2013. (Photo credit Gage Skidmore/Flickr)

    White House taps old policies for new government makeover

    New guidance from OMB advises agencies to use shared services, GWACs and federal schedules for acquisition, and to leverage IT wherever possible in restructuring plans.

  • Shutterstock image (by Everett Historical): aerial of the Pentagon.

    What DOD's next CIO will have to deal with

    It could be months before the Defense Department has a new CIO, and he or she will face a host of organizational and operational challenges from Day One

  • USAF Gen. John Hyten

    General: Cyber Command needs new platform before NSA split

    U.S. Cyber Command should be elevated to a full combatant command as soon as possible, the head of Strategic Command told Congress, but it cannot be separated from the NSA until it has its own cyber platform.

  • Image from Shutterstock.

    DLA goes virtual

    The Defense Logistics Agency is in the midst of an ambitious campaign to eliminate its IT infrastructure and transition to using exclusively shared, hosted and virtual services.

  • Fed 100 logo

    The 2017 Federal 100

    The women and men who make up this year's Fed 100 are proof positive of what one person can make possibile in federal IT. Read on to learn more about each and every winner's accomplishments.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group