Power Grid Vulnerability

The Electricity Subsector Coordinating Council (ESCC) is the main liaison organization between the federal government and the electric power industry. Senators Cory Gardner and Michael Bennet introduced legislation intended to improve grid security nation-wide. In his 2015 book, Ted Koppel argues that all utilities, but especially smaller ones, do not truly air-gap their operations from the internet, leaving significant attack surfaces.

” says Erika Willis, the program manager for the substations team at the Electric Power Research Institute (EPRI). While not all data is publicly available, Coe says there’s been a “tenfold” increase over the past decade in the number of reported physical attacks on the grid. A shooting attack on two substations in Moore County, N.C., caused a five-day power outage for more than 40,000 people in December 2022. The industry is expanding equipment sharing programs—like the Spare Transformer Equipment Program, SpareConnect, and Grid Assurance—to improve grid resiliency. Finally, electric utilities regularly share transformers and other equipment through long-existing bilateral and multilateral sharing arrangements and agreements. As such, the electric power industry employs threat mitigation known as “defense-in-depth” that focuses on preparation, prevention, response, and recovery to “all hazard” threats to electric grid operations.

In the following, we first describe the communication infrastructure of power grids, before focusing on the fundamental security challenges resulting from an increasing interconnection of power grids. With the increasing digitalization of power grids, operators are confronted with rapid changes in the amount of communication necessary and the means through which this communication is conducted. To this end, we motivate the need for cybersecurity when operating power grids and outline promising approaches to provide security at different levels of abstraction.

APPA Contact

Inclusion in an NLM database does not imply endorsement of, or agreement with, the contents by NLM or the National Institutes of Health. Members can communicate and share ideas, participate in discussion forums, send email blasts, create file libraries, organize conference calls, and keep track of important dates and upcoming events. To facilitate managing cybersecurity supply chain risks, a committee of representatives of EEI member companies developed this model to align cybersecurity requirements and to encourage adoption by the vendor community. The ESCC facilitates and supports policy- and public affairs-related activities and initiatives designed to enhance the reliability and resilience of the energy grid.

• Naturally, the security of their systems is not as tightly controlled as those of traditional energy companies.
• Please try to keep recent events in historical perspective and add more content related to non-recent events.
• Some German officials cite domestic extremism and fears of Russian sabotage in recent years as reasons for heightened security concerns over critical infrastructure.
• In the following, we discuss the most important attack vectors an attacker can exploit to access a PCN.
• Protecting the nation’s energy grid and ensuring a reliable and affordable supply of energy are top priorities for America’s electric companies.
• From there, the attacker can compromise substations or field devices, potentially leading to a blackout.

Using AI can improve detection of break-ins and damage to fencing around substations, Willis says. And in 2023, a neo-Nazi leader was among two arrested in a plot to attack five substations around Baltimore with firearms, part of an increasing trend in white supremacist groups planning to attack the U.S. energy sector. The electric power industry works closely with the federal government, including NERC, FERC, DOE, and DHS, on matters of critical infrastructure protection. A 2024 Thales report found that 42% of critical infrastructure companies – including energy providers – suffered data breaches during the year. Consequently, grid operators need to develop and maintain actionable incident response plans and guidelines, supporting their employees with precise instructions also at the technical level on how to https://homebeachlove.com/how-to-build-utilities-on-a-site-near-the-sea.html react to security incidents.

How long does a grid-down event last?

This section is an excerpt from 2013 Metcalf sniper attack § lead.edit On 31 December 1975, an electrical substation in Seattle, Washington was bombed by the George Jackson Brigade. In March and April 1975, a “closely guarded” Pacific Gas and Electric substation was bombed twice in two separate incidents, knocking out power to more than 22,000 customers.

In future attacks, similar methods could, e.g., allow attackers to overload power lines even if these are secured by protection devices, potentially https://www.softarmy.com/60942/author-wopti-utilities.html leading to physical damage. In the attacks on Ukrainian grid operators in 2015 , attackers gained access to the PCN through lateral movement from the office network (cf. Figure 1). From there, the attacker can compromise substations or field devices, potentially leading to a blackout. To address these potential hazards, the electric power industry is working hard to enhance the resilience of the energy grid, to mitigate the potential impact of an EMP, and to accelerate recovery from potential incidents.

As grid operators often use their https://homadeas.com/practical-advice-on-choosing-houses-and-recommendations-for-their-purchase-and-arrangement.html own physical networks for communication, physical security is directly related to cybersecurity. Future work is required to automatically adapt to the differences between grid operators, as the used hardware, software, and protocols will be different. In combination with a distributed IDS, such approaches can lead to substantially more secure power grids, while introducing a minimum of extra hardware into the PCN. Most of the communication in a PCN in the energy sector is conducted between the control room and substations or field devices.

In 2024, APPA was awarded a $4 million grant to launch the Cyber Pathways Program to improve the cybersecurity posture of public power utilities with limited resources, serving military installations, or that are critical to the bulk-power system. APPA and public power utilities play a leadership role on the ESCC, which includes utility CEOs and trade association leaders representing all segments of the industry. Finally, CISA 2015 set up policies and procedures for voluntary sharing of cybersecurity threat information between and among the federal government and private entities (the definition of which includes public power utilities) and provides limited liability protection for these activities. The electric sector is unique in that it has long been subject to cyber incident reporting mandates to the Department of Energy (DOE) via an Electricity Emergency Incident and Disturbance Report (OE-417) and NERC/FERC. On February 19, 2026, a 23-year-old male law school student from Albany, New York, rammed a rental vehicle through the perimeter fence of a substation in Boulder City, Nevada, before dying from a self-inflicted gunshot wound. Two men with previous criminal records of thefts were arrested on January 3, with the reported motive being to cut the power to serve as part of a wider plan to burglarize several businesses in the area.

Model Procurement Contract Language Addressing Cybersecurity Supply Chain Risk

More sophisticated physical security may not only deter attackers but also act as a part of a general IDS. For example, a motivated attacker could break into a substation and infect local devices with malware or otherwise tamper with the available access to the PCN. Even if attackers neither have full access to the PCN nor can inject (false) information, they may still be able to manipulate certain devices and effectively render them non-functional to launch a denial of service attack against parts of the power grid . Such an attack would likely be local in scope with a medium impact, as attackers could only execute previously determined attacks. Even if PCNs are air-gapped, i.e., physically isolated from other networks, such as the office network to prevent lateral movement, attackers can still try to attack a PCN by strategically placing USB drives containing malware around a facility they are targeting. Hence, such a theft could be used as camouflage by cyber attackers to deter grid operators from even looking for traces of a cyber attack.