Regulators Worry about Cyberthreat to Grid

By Martin Rosenberg

Serious gaps in grid cybersecurity particularly in distributions systems are a concern, a panel of state regulators said at a national gathering here.

Federal officials charged with protecting the grid are most focused on long-haul transmission networks and claim not to have control of state distribution grids, said Arthur House, chairman of a member of the Connecticut Public Utilities Regulatory Authority and author of that state’s cybersecurity action plan.

He was speaking at the summer meeting of the National Association of Regulatory Utility Commissioners.

“We are extremely good at reacting to disasters in the United States, but we are not good at preventing them, House said. “Not taking cybersecurity seriously can be a very serious threat for us.”

“I am worried,” he said. “There’s a dangerous lack of sharing information.”

Philip Jones, a member of the Washington Utilities and Transportation Commission and past NARUC president who has worked closely on cybersecurity issues for several years, said that mandatory standards for distribution system security may be needed.

State regulators and their staffs are stretched thin dealing with many pressing issues as the utility business undergoes radical transformation. “We are stretched too thin,” House said.

There are five or six ways that criminals or terrorists can gain access to a utility, he said.

“A lot of time, the utilities don’t know they have been penetrated,” he said.

Many utilities maintain that there is an “air gap” that separates the public internet from their most sensitive computer systems that control vital infrastructure, but that, according to House, is “a discredited concept.”

House agrees with other cybersecurity experts who predict a debilitating cyberattack on the grid is inevitable and it could cripple an urban center or region for a prolonged period.

“We have to imagine a month or more of a lack of utility service,” he said.

Cheryl LaFleur, a member of the Federal Energy Regulatory Commission, said that the grid must be made more robust since every potential threat cannot be thwarted.

“We need to build resilience into the system so we have more ways to get the power back on,” she said.

This article originally appeared on our sister site The Energy Times.