NIST readies Smart Grid security architecture

A cybersecurity working group developing a security architecture for the Smart Grid expects to issue a preliminary report for public comment soon, outlining how security requirements will be incorporated into the design of the nation’s next-generation power distribution system.

Related story:

 First draft of a framework for building a Smart Grid unveiled

The security plan is a critical part of the Smart Grid interoperability effort being spearheaded by the National Institute of Standards and Technology (NIST). The draft document, NIST Interagency Report 7628, "Smart Grid Cyber Security Strategy and Requirements," could be released as early as today and will be available online.

It is being developed in conjunction with the Smart Grid interoperability framework, a first draft of which was released yesterday by NIST. Annabelle Lee, senior cybersecurity strategist at NIST’s Computer Security Division, said Thursday that the security document, which will include a comprehensive set of security requirements, is expected to be finalized by March.

The Smart Grid program was established in the Energy Independence and Security Act of 2007, which mandated that security be built into the system that would use intelligent networking and automation to better control the flow and delivery of electricity to consumers. This would require a two-way flow of electricity and information between the power plant and the end user, and to points in between.

“History has shown that you can’t add security later” to complex systems, said George Arnold, NIST deputy director of technical services, who is leading the effort to define Smart Grid interoperability standards. “We’re putting the security architecture and requirements up front.”

“This is very different for us,” said Lee. The Computer Security Division traditionally has been called upon to develop security standards and requirements for systems that already have been deployed.

Developing a security architecture in parallel with the system design and engineering processes is a challenge, because the overall architecture of the system has not yet been determined. But it is necessary to conduct the different processes at the same time because development and even deployment of some elements of the Smart Grid already are under way.

“The urgent need for this framework was vastly accelerated with the passing of the recovery act,” which provides millions of dollars to jump-start development of Smart Grid technology, said NIST Deputy Director Pat Gallagher (who has been nominated by President Barack Obama to become director of NIST).

The interoperability framework for the Smart Grid is expected to be finalized by mid-November and is the first of a three-phase program to develop interoperability standards. In the second phase, an interoperability panel will begin meetings on Nov. 16 to assist development of remaining technical standards needed to ensure interoperability. This work is expected to be completed next year. The third phase is development of an interoperability testing and certification program. Gallagher called the timetable aggressive, but realistic.

Deployment of a Smart Grid offers a greenfield opportunity because the existing grid, parts of which are 50 years old or older, was not designed to support alternative energy sources such as wind and solar power, and the two-way flow of energy and data. But this wholesale upgrade also makes it imperative that security be built in now, because the grid lifecycle is measured in decades rather than years, as it is for much of the rest of our information infrastructure. Equipment being designed for deployment now might not be replaced for decades.

Smart Grid security requirements will be developed for specific domains, business and mission functions and interfaces, as well as for the overall grid. But they are being developed at a high level and will not be spelled out for specific systems or components because of the impossible complexity of that job.

The security requirements and architecture will address not only deliberate attacks, but errors, failures and natural disasters that also could destabilize the grid. Smart Grid risks being addressed by the working group include:

  • Increasing complexity, which could introduce vulnerabilities and increase exposure to attacks and errors;
  • Interconnected networks, which could introduce common vulnerabilities;
  • Increasing vulnerability to disruption of communications and the introduction of malicious code;
  • Increased number of entry points for exploits; and
  • The potential for loss of confidentiality, including breach of customer privacy.

The security architecture being developed will identify interfaces between functional domains of the new grid and categorize them according to the criticality of their data accuracy and availability. The constraints, issues and impacts of breaches at these interfaces will be considered for each category, and security requirements will be developed.

The next steps in developing the security plan will be to assess existing standards that could apply to security requirements, to identify gaps where adequate standards do not now exist, and to assess development of new standards to address those gaps.

About the Author

William Jackson is a Maryland-based freelance writer.

FCW in Print

In the latest issue: Looking back on three decades of big stories in federal IT.


  • Anne Rung -- Commerce Department Photo

    Exit interview with Anne Rung

    The government's departing top acquisition official said she leaves behind a solid foundation on which to build more effective and efficient federal IT.

  • Charles Phalen

    Administration appoints first head of NBIB

    The National Background Investigations Bureau announced the appointment of its first director as the agency prepares to take over processing government background checks.

  • Sen. James Lankford (R-Okla.)

    Senator: Rigid hiring process pushes millennials from federal work

    Sen. James Lankford (R-Okla.) said agencies are missing out on younger workers because of the government's rigidity, particularly its protracted hiring process.

  • FCW @ 30 GPS

    FCW @ 30

    Since 1987, FCW has covered it all -- the major contracts, the disruptive technologies, the picayune scandals and the many, many people who make federal IT function. Here's a look back at six of the most significant stories.

  • Shutterstock image.

    A 'minibus' appropriations package could be in the cards

    A short-term funding bill is expected by Sept. 30 to keep the federal government operating through early December, but after that the options get more complicated.

  • Defense Secretary Ash Carter speaks at the TechCrunch Disrupt conference in San Francisco

    DOD launches new tech hub in Austin

    The DOD is opening a new Defense Innovation Unit Experimental office in Austin, Texas, while Congress debates legislation that could defund DIUx.

Reader comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group