How long can the nation’s electrical power grid endure without a catastrophic event? It’s a question that energy and homeland security officials routinely ask – along with what they can do to prevent or mitigate such a calamity. Utilities and their corporate customers also wonder what they can and should do.
Their concern is warranted for several scary reasons. First, the grid has been judged in “poor to fair condition and mostly below standard,” by the American Society of Civil Engineers. In early 2004, it gave the grid a D-plus grade when evaluating it for security and other vulnerabilities. The engineering trade group said a large portion of the system “exhibits significant deterioration.” It warned of a “strong risk of failure.”
Second, cyber attackers are increasing their attempts to hack into the U.S. power grid software and they’re getting more sophisticated, warns the U.S. Department of Homeland Security. Such attacks have been occurring every four days on average so the threat of a major disruption of the electrical supply system is real. It could severely damage the nation’s economy. Simply imagine the effect of a major power supply failure on everyday commerce as well as its impact on Americans’ health and well-being.
A Successful Grid Attack
More than 50 utilities have contended the power grid is vulnerable to a major outage. One has already occurred. The National Security Agency said the grid was hacked successfully in November 2014 by several foreign governments, which likely were Russia, Iran, and China. This certainly leaves the grid vulnerable to physical damage. One U.S. cybersecurity company even predicts such attacks will disrupt American electricity in 2015.
No major loss of electrical power has occurred that approaches the cascading outage that happened across the Northeast in 2003. Still, the nation’s power grid registers more blackouts than any other developed country, reports the Energy Department and the North American Electric Reliability Corporation, or NERC. They cost U.S. businesses as much as $150 billion a year, estimates the Energy Department.
At least one utility has recorded a successful hacking. On April 16, 2013, perpetrators launched a coordinated attack on a Pacific Gas & Electric substation in Metcalf, Calif., that caused $15 million in damage to its fiber-optic lines and transformers.
A third factor that could spark a catastrophe affecting the power grid is the sun. It regularly propels geo-magnetic storms and, industry officials worry, a flare could hit the earth with an electromagnetic pulse whose energy burst could equal that of a nuclear bomb. It’s not farfetched. In 1859, a massive solar flare struck the earth and generated fires in telegraph offices and extraordinary northern lights displays.
Then think in terms of 2015 and how much of modern life requires electric power. A geomagnetic storm could trigger trillions of dollars in damages. On a lesser scale, disrupting the power grid could simply involve a smaller incident of an electromagnetic pulse created with everyday equipment.
What Can be Done?
What are industry, lawmakers, regulators, and national security officials to do, including those outside the U.S.? The United Kingdom and many other developed countries in Europe and elsewhere are just as fearful that their own electrical power supplies will be compromised.
Further, what can companies do to prepare for potential consequences of power-supply disruption? What steps can help prepare them in terms of business continuity and disaster recovery? These are the vital questions that keep a growing number of IT, business continuity, risk management, operations chiefs, senior executives, and directors awake at night.
All of these watchdogs and executives are looking for a shield as they come to grips with the likelihood that a significant power-supply disruption will occur. This explains why the nation’s homeland security, cybersecurity, and national defense officials are stepping up their planning, preparation, precautions, and responses to a power grid failure. Ultimately, they’re looking for an effective defense to protect the power grid and other vital infrastructure.
It’s difficult, of course, to grasp specifically what these security officials are doing since they certainly don’t want to signal to cyber criminals – which include nation-state elements and sub-national terrorist groups – about their defensive – or offensive – plans and counterattack moves. They also recognize that cyber attackers are stepping up their bombardment and getting more sophisticated in their tactics.
Power Grid Old, Decaying
Further, U.S. officials realize that while the U.S. can upgrade its computer technology and intelligence gathering, the problem persists that the nation’s power grid assets are old and decaying. It’s not that the U.S. isn’t moving to modernize the nation’s grid. Through the American Recovery and Reinvestment Act of 2009, the Energy Department has invested roughly $4.5 billion to enhance the reliability of the power grid. Still, much more spending to modernize the grid is essential.
A Congressional commission on electromagnetic pulse, since disbanded, spent eight years developing a plan to protect all infrastructures from such disruptions and set the price tag at $10-20 billion. The commission in 2008 estimated it would cost $2 billion alone to harden roughly 2,000 large- and medium-sized transformers that form the electric power grids’ critical nodes.
Any enhanced infrastructure must be teamed with new cyber-security controls that previously weren’t connected to computer technology. Since 2010, the energy department has invested more than $100 million to develop a grid platform that can handle a cyberattack while maintaining critical functions.
Here’s the reality, though. More than 450,000 miles of high-voltage transmission lines connect the grid across the country, and these alone can pose challenges. Thus, officials must focus on protection that encompasses guarding the perimeter, detecting intruders and responding to any intrusions.
Cybersecurity Steps
The Obama administration also has proposed a comprehensive strategic approach to cybersecurity for the grid that envisions these additional initiatives:
- passisting public-private partnerships to accelerate cybersecurity efforts for the grid
- funding research and development of advanced technology to create a secure and resilient electricity infrastructure
- backing the development of cybersecurity standards to provide a baseline to protect against known vulnerabilities
- helping share actionable and relevant threat information in a timely manner
- advancing risk-management strategies that improve decision-making
- bolstering the cybersecurity workforce within the electric sector
Some security experts have voiced concern that alternative energy sources – wind farms, solar panels, and smart meters – could boost the vulnerability to computer hacking of the electricity grid. They reason that these add additional portals to be breached, making it vulnerable from all degrees. Any breaches would be of industrial control systems.
Steps Companies Can Take
Companies can take – or already are taking – several steps to prepare for responding to and repelling a cybersecurity attack. Increasingly, enterprises’ chief information officers and security leaders are turning to resiliency plans to mitigate the impact of any attempt or success at hacking into their IT systems.
They are considering or employing several defenses in the event an attack strikes the power grid. These include the following:
Recovery testing: This involves assessing current business continuity plans and adjusting them where needed. Among other facets, the program includes using the employees who would be involved in a disaster in testing to best create a realistic test experience.
But it’s not just an A team that’s assembled because some of those members may not be available when a disaster strikes. B and C teams also are created, and those employees are tested, too, and put on the hot seat and made aware of what’s expected of them.
The businesses that recover best after a natural disaster are those that are “on point” and know when to deploy their people, how to get them to a back-up facility. What hurricanes have uncovered is that when Team A couldn’t be deployed, Team B often were fish out of water and didn’t have a clue about what to do.
The program also determines how often testing should occur, which should be at least annually and, preferably, twice a year. Plans should be tested with the team members there, and then any gaps should be closed when identified by test results.
Crisis planning: This includes helping customers plan and prepare for a disaster by monitoring weather across the country and obtaining and grasping cybersecurity intelligence gleaned by a number of private and government agencies. Companies can take several steps to best prepare their people, processes, and tools for either a natural or manmade disaster.
They can do this through building timelines, addressing critical trigger points and emphasizing the importance of maintaining their disaster-recovery plans. In preparing their employees, for instance, companies can consider their telecommuting and work strategies, focus on internal resource planning, and ensure appropriate workgroup space is lined up should a disaster occur.
One suggested preparation involves mobile recovery units that provide companies with an IT workspace should their space be impacted during or after a disaster. These “work away from work” centers help companies remain operational through the recovery stage, as they did during Hurricanes Sandy and Katrina.
Consider what companies learned a dozen years ago, in April 2003, when a power blackout in the Cleveland area spread to become the biggest in U.S. history. The lessons learned can apply to preparing for a power grid attack. They learned to:
- Test their disaster-recovery plans regularly – at least once and preferably twice a year – with disaster simulations to keep the plans ready and on the cutting-edge.
- Arrange for a so-called metrocenter, which is a recreated office and dedicated workspace away from their offices where employees can be up and running within minutes.
- Upgrade backup systems. One steel producer installed a two-megawatt generator to ensure that a caster can clear itself of molten metal before shutting down. Another business upgraded its phone system so it could switch to another carrier if one is down. Still another opened a second call center away from its main one so that in case of one office losing power, it could rely on the second call center.
- Establish contingency plans for back-up generators to be used for operations other than treating patients, which can include back-up power for food storage, including arranging for refrigerated trucks if power goes out.
- Set up delivery contracts with vendors that can supply bottled water and other essential supplies during the blackout. This could include “go to war” boxes with batteries, flashlights, extension cords and other emergency gear, and employees assigned to retrieve these supplies and distribute them.
While most companies can’t help our nation’s security professionals and even utility officials with their crisis preparedness planning involving the power grid, they certainly can plan their own defenses as well as business continuity and disaster recovery preparations and initiatives.
In summary, companies must develop a risk-assessment plan or refresh the one they’ve got. This involves identifying the risks, hazards, weaknesses, and vulnerabilities they could face. It also involves updating any emergency-response plan, including evacuation, shelter, and lockdown plans. This might encompass data security and process systems, among others.
They also must analyze how to handle each risk. This might entail retaining a professional disaster-recovery company to provide the help quickly that will be needed. This is true especially in restoring the IT infrastructure, recovering data, and keeping critical information secure.
Further, they should update the crisis-communications plan for keeping employees, customers, vendors, other stakeholders, and the media in the know when a crisis occurs. They should also update the employee training plan to ensure employees know the protective actions to take during a manmade crisis or natural disaster.
The message today is plain: to ensure resilience, preparedness is vital.
Robert DiLossi is director of crisis management at Sungard Availability Services, which offers an array of services to strengthen an organization’s security posture.
