[Senate Hearing 112-529]
[From the U.S. Government Publishing Office]
S. Hrg. 112-529
ELECTRIC GRID SECURITY
=======================================================================
HEARING
before the
COMMITTEE ON
ENERGY AND NATURAL RESOURCES
UNITED STATES SENATE
ONE HUNDRED TWELFTH CONGRESS
SECOND SESSION
TO
EXAMINE THE STATUS OF ACTION TAKEN TO ENSURE THAT THE ELECTRIC GRID IS
PROTECTED FROM CYBER ATTACKS
__________
JULY 17, 2012
Printed for the use of the
Committee on Energy and Natural Resources
_____
U.S. GOVERNMENT PRINTING OFFICE
75-809 PDF WASHINGTON : 2012
-----------------------------------------------------------------------
For sale by the Superintendent of Documents, U.S. Government Printing
Office Internet: bookstore.gpo.gov Phone: toll free (866) 512-1800; DC
area (202) 512-1800 Fax: (202) 512-2104 Mail: Stop IDCC, Washington, DC
20402-0001
COMMITTEE ON ENERGY AND NATURAL RESOURCES
JEFF BINGAMAN, New Mexico, Chairman
RON WYDEN, Oregon LISA MURKOWSKI, Alaska
TIM JOHNSON, South Dakota JOHN BARRASSO, Wyoming
MARY L. LANDRIEU, Louisiana JAMES E. RISCH, Idaho
MARIA CANTWELL, Washington MIKE LEE, Utah
BERNARD SANDERS, Vermont RAND PAUL, Kentucky
DEBBIE STABENOW, Michigan DANIEL COATS, Indiana
MARK UDALL, Colorado ROB PORTMAN, Ohio
JEANNE SHAHEEN, New Hampshire JOHN HOEVEN, North Dakota
AL FRANKEN, Minnesota DEAN HELLER, Nevada
JOE MANCHIN, III, West Virginia BOB CORKER, Tennessee
CHRISTOPHER A. COONS, Delaware
Robert M. Simon, Staff Director
Sam E. Fowler, Chief Counsel
McKie Campbell, Republican Staff Director
Karen K. Billups, Republican Chief Counsel
C O N T E N T S
----------
STATEMENTS
Page
Bingaman, Hon. Jeff, U.S. Senator From New Mexico................ 1
Cauley, Gerry, President and Chief Executive Officer, North
American Electric Reliability Corporation...................... 25
McClelland, Joseph, Director, Office of Electric Reliability,
Federal Energy Regulatory Commission........................... 4
Murkowski, Hon. Lisa, U.S. Senator From Alaska................... 2
Snitchler, Todd A., Chairman, Public Utilities Commission of Ohio 32
Wilshusen, Gregory C., Director, Information Security Issues,
Government Accountability Office............................... 11
APPENDIX
Responses to additional questions................................ 57
ELECTRIC GRID SECURITY
----------
TUESDAY, JULY 17, 2012
U.S. Senate,
Committee on Energy and Natural Resources,
Washington, DC.
The committee met, pursuant to notice, at 10 a.m. in room
SD-366, Dirksen Senate Office Building, Hon. Jeff Bingaman,
chairman, presiding.
OPENING STATEMENT OF HON. JEFF BINGAMAN, U.S. SENATOR FROM NEW
MEXICO
The Chairman. OK. Why don't we go ahead and get started?
I am advised that Senator Murkowski is on her way, but
urged us to proceed. This morning's hearing is to examine the
status of actions taken by the Federal Energy Regulatory
Commission or FERC, and the North American Electric Reliability
Corporation or NERC, and the States to protect the electric
grid from computer attacks on their facilities and control
systems.
I don't think we need to talk much about the serious nature
of this issue. Last week, we experienced a week-long outage in
much of this region. It was a weather-related outage, but it
demonstrates how important reliable service on the electric
grid is.
We read every day of newly discovered attacks or threats on
computer systems in this country and around the world.
According to the Director of National Intelligence, there's
been a dramatic increase in the frequency of malicious cyber
activity, targeting U.S. computers and networks, including a
more than tripling of the volume of malicious software, since
2009. So, the threat is real, and it is serious.
In 2005, we gave FERC the authority to name an entity to
develop and enforce standards to protect the reliability of the
grid. I believe that there are two things that we can say about
the system that has emerged since then.
First, the current reliability system does have a mandatory
character, so the electric grid is the only critical
infrastructure in this country that has some form of an
enforceable standard for cybersecurity.
Second, the current reliability system that has emerged is
cumbersome and overly complicated. This may be adequate to deal
with reliability concerns like, standards for trimming trees so
that they do not fall on transmission lines, but when it comes
to cyber attacks, I am concerned that the current system is not
adequate.
The process to develop standards started in earnest in 2006
when NERC filed a series of reliability standards with NERC; a
number of them related to cybersecurity and FERC found them
wanting. In a series of filings since then, NERC has corrected
some of the shortcomings that the FERC highlighted.
As recently as April, version 4 of the cyber standards was
approved, with the provision that NERC address the remaining
inadequacies by the end of the first quarter of next year. That
means that we are here today in this committee, 7 years after
we passed the law, and we are still waiting for this process to
produce the full set of adequately protective standards that we
need. That cumbersome process has to address a threat, whose
nature is rapidly changing. The standards that are in place may
not be flexible enough to deal with emerging threats, and we
still do not have an effective system in place to require
action in the face of an imminent cyber attack.
NERC has developed a system of alerts to help the industry
with newly discovered threats. I will have some questions about
that system, how that system is working in practice.
The concerns that have prompted this hearing are ones that
have resulted in bipartisan cybersecurity legislation that we
have reported from this committee, both this Congress and in
the last Congress. In 2010, Senator Murkowski and I agreed on
an expedited approach to cybersecurity standards that was
centered at FERC and that passed the committee unanimously.
That bill was hotlined for passage in the Senate at the end of
the last Congress. It ran into holes from two of our colleagues
and, perhaps, more.
Last year, Senator Murkowski and I reworked the proposal
into one that featured a greater role for NERC, but allowed
FERC to set effective deadlines for action and also gave the
Secretary of Energy emergency cybersecurity authority. Once
again, that bill passed this committee unanimously.
I don't believe that the cyber threat facing the electric
grid has gotten any less serious since last year, when we acted
on a bipartisan basis to pass our legislation out of the
committee.
In the testimony for today's hearing, there are suggestions
that there are additional cyber issues that also need focused
attention, particularly with respect to the implementation of
smart grid technologies. We need to address these
vulnerabilities that are clearly before us. The bill that
passed this committee unanimously would be an excellent place
to start. It did a good job of balancing the need to avail
ourselves of the expertise in industry on these issues, with
the need to act expeditiously. Nothing since then has changed
the need for clear authority to deal with immediate emergencies
and longer-term vulnerabilities.
As we all agreed last year, processes that take years to
bear fruit, may be sufficient for less urgent reliability
issues, but not for the challenges we face in cybersecurity.
So, I look forward to hearing from the witnesses.
Let me defer to Senator Murkowski for any opening
statements she would like to make.
STATEMENT OF HON. LISA MURKOWSKI, U.S. SENATOR
FROM ALASKA
Senator Murkowski. Thank you, Mr. Chairman. Welcome, to all
the witnesses this morning. I appreciate the hearing today.
Of course, the purpose of this morning's hearing is to take
another--and, perhaps, a closer--look at the ongoing efforts to
protect our Nation's grid from cyber attacks. I do think it is
important that we recognize the tremendous amount of work that
has already gone into safeguarding the grid's reliability.
Back in 2005, Congress directed FERC to select an electric
reliability organization, now known as the NERC, and tasked it
with establishing and enforcing mandatory reliability
standards, including cyber standards.
I think it has been a difficult, time-consuming process,
but I would like to commend NERC for the professional and
balanced way that it has consistently met its responsibilities.
There is no question, Mr. Chairman, as you point out, that
cybersecurity is an absolutely critical issue. It should be
addressed by this Congress. I am certain that every member of
this body is concerned that our Nation may be vulnerable to
cyber attacks that could have severe economic and security
ramifications.
We see stories about this just about every day, on
individuals, on companies, on the Government--these cyber
incursions. It is time for us to take steps to protect
ourselves from a very real and emerging threat.
Last year, as you point out, Mr. Chairman, the Energy
Committee did report out a sector-specific cybersecurity bill.
This action was taken in response to the majority leader's
directive to the various committees with cyber jurisdiction to
produce their own bills. At which point, they would all be
stitched together into a single piece of cybersecurity
legislation.
I think, Mr. Chairman, that the Energy Committee was the
only committee to have actually done just exactly that. But
since that time, now over a year ago, circumstances have
evolved. I think there is near agreement that we need a
comprehensive approach to the cybersecurity problem. Some would
have us believe that only the Department of Homeland Security
and a host of new Federal regulations will protect us from
persistent cyber threats.
But I don't think that heavy-handed static requirements
from yet another Federal regulator will address the very real
threat that we face. I think, instead, that we need a much more
nimble approach to deal with cyber-related threats that are
constantly growing and always changing.
I have joined with a number of other Ranking Member
colleagues to introduce, what we're calling, the Secure IT Act.
This is S. 3342. I think it's a pragmatic approach to this
issue. We focus on 4 areas that, I believe, we can draw
bipartisan support for. That is within the area of information
sharing. We have got FISMA reform, criminal penalties,
additional research.
But what the Secure IT Act does not do, I think, is equally
important. It does not add new layers of bureaucracy and
regulation that will serve little purpose and achieve meager
results. I think it is a pretty straightforward approach to
cybersecurity that can go a long ways in addressing our
problem.
Mr. Chairman, I thank you for convening this hearing. I
look forward to hearing what the witnesses have to say on the
actions that have been taken to date, as well as the ongoing
efforts to secure the grid at both the transmission and the
distribution level.
The Chairman. Thank you very much. I would just point out
that the Majority Leader has advised, I think, everyone who's--
listens to his statements that he hopes we can move to
cybersecurity legislation on the Senate floor between now and
the time we adjourn in August, and so, I think this hearing is
particularly timely for that reason.
Let me introduce our 4 witnesses.
First is, Mr. Joseph McClelland, Director of the Office of
Electric Reliability at the Federal Energy Regulatory
Commission.
Next is, Mr. Gregory C. Wilshusen, who is the Director of
Information and Technology, with the Government Accountability
Office.
Third is, Mr. Gerry Cauley, who is President and Chief
Executive Officer with the North American Electric Reliability
Corporation, NERC. Thank you very much for being here.
Mr. Todd Snitchler, who is the Chairman of the Public
Utility Commission of Ohio. Thank you very much for being here.
Mr. McClelland, why don't you start. If each of you could
take 5 or 6 minutes and give us the main things you think we
need to understand about the issue. We will then have some
questions.
STATEMENT OF JOSEPH MCCLELLAND, DIRECTOR, OFFICE OF ELECTRIC
RELIABILITY, FEDERAL ENERGY REGULATORY COMMISSION
Mr. McClelland. Thank you, Mr. Chairman.
Mr. Chairman, Ranking Member, and members of the committee,
thank you for the privilege to appear before you today to
discuss the security of the electric grid. My name is Joe
McClelland, and I am the Director of the Office of Electric
Reliability at the Federal Energy Regulatory Commission.
I am here today as a Commission staff witness and my
remarks do not necessarily represent the views of the Chairman
or any individual commissioner.
The Commission is committed to protecting the reliability
of the Nation's bulk power system. Nevertheless, limitations in
Federal authority do not fully protect the grid against
physical and cyber threats. My testimony summarizes the
Commission's oversight of the reliability of the electric grid
under section 215 of the Federal Power Act, and the
Commission's implementation of that authority, with respect to
cyber-related reliability issues, primarily through Order 706
In the Energy Policy Act of 2005, Congress entrusted the
Commission with a major new responsibility, to oversee
mandatory enforceable reliability and cybersecurity standards
for the Nation's bulk power system. This authority is in new
section 215 of the Federal Power Act.
Under the new authority, FERC cannot author or modify
reliability standards, but must select an Electric Reliability
Organization, or ERO, to perform this task. The ERO develops
and proposes reliability standards or modifications for the
Commission's review, which it can then either approve or
remand.
If the Commission approves the proposed reliability
standard, it applies to the users, owners, and operators of a
bulk power system and becomes mandatory in the United States.
If the Commission remands a proposed standard, it is sent back
to the ERO for further consideration.
The Commission selected the North American Electric
Reliability Corporation, or NERC, as the ERO. It is important
to note that FERC's jurisdiction and reliability authority is
limited to the ``bulk power system,'' as defined in the FPA,
which excludes Alaska and Hawaii distribution systems, and can
exclude transmission facilities in certain large cities, such
as New York.
In addition to the reliability authority, FERC is also
charged with oversight of the cybersecurity of the bulk power
system. As is the case with non-security issues, FERC's
authority under 215 of our cybersecurity is exercised through
the reliability standards developed by the ERO and approved by
FERC. Pursuant to this duty, FERC approved 8 cybersecurity
standards known as the Critical Infrastructure Protection
standards, or CIP standards, proposed by NERC, while
concurrently directing modifications to them in January 2008.
Three sets of modifications, responding to the Commission's
directives, have been received from the ERO, and the last was
approved earlier this year.
Although the CIP standards are approved, full compliance
with these revised standards will not be mandatory until 2014.
More importantly, in approving the latest revision of the CIP
standards, the Commission recognized that they are an interim
step and raised its concern that the newly revised standards do
not provide enough protection to satisfy the Commission's
January 2008 Order. Thus, the Commission established a deadline
for the end of the first quarter of 2013, for NERC to file
standards in compliance with the outstanding directives in that
Order.
Physical attacks against the power grid can cause equal or
great destruction than cyber attacks. One example of a physical
threat is an electromagnetic pulse, or EMP, event.
In 2001, Congress established a commission to assess the
threat from EMP. In 2004 and, again, in 2008, the Commission
issued its reports. Among the findings in the reports were that
a single EMP attack could seriously degrade or shut down a
large part of the electric power grid. Depending upon the
attack, significant parts of the electric infrastructure could
be, ``Out of service for periods measured in months to a year
or more.''
In addition to man-made attacks, EMP events are also
naturally generated, caused by solar flares and storms,
disrupting the Earth's magnetic field. Such events can be
powerful and can also cause significant and prolonged
disruptions to the power grid.
The standards development system utilized under FPA 215
develops mandatory reliability standards, using an open and
inclusive process, based on consensus. Although it can be an
effective mechanism with dealing with the routine requirements
of the power grid, it is inadequate when addressing threats to
the power grid that endanger national security.
Despite its active role in approving reliability standards,
FERC's current legal authority is insufficient to assure
direct, timely, and mandatory action to protect the grid,
particularly where certain information should not be publicly
disclosed.
Any new legislation should address several key concerns.
First, legislation should allow the Federal Government to take
action before a cyber or physical national security incident
has occurred.
Second, any legislation should ensure appropriate
confidentiality of the sensitive information submitted,
developed, or issued under this authority.
Third, if additional reliability authority is limited to
the bulk power system, as that term is currently defined in the
FPA, it would not authorize Federal action to mitigate cyber or
other national security threats to reliability that involve
certain critical facilities in major population areas.
Finally, it is important that entities be able to recover
costs that they incur to mitigate vulnerabilities and threats.
Thank you for your attention today. I am available to
address any questions that you may have.
[The prepared statement of Mr. McClelland follows:]
Prepared Statement of Joseph McClelland, Director, Office of Electric
Reliability, Federal Energy Regulatory Commission
Mr. Chairman, Ranking Member and Members of the Committee:
Thank you for this opportunity to appear before you to discuss the
security of the electric grid. My name is Joseph McClelland. I am the
Director of the Office of Electric Reliability (OER) of the Federal
Energy Regulatory Commission (FERC or Commission). The Commission's
role with respect to reliability is to help protect and improve the
reliability of the Nation's bulk power system through effective
regulatory oversight as established in the Energy Policy Act of 2005. I
am here today as a Commission staff witness and my remarks do not
necessarily represent the views of the Commission or any individual
Commissioner.
The Commission is committed to protecting the reliability of the
nation's bulk electric system; nevertheless, the Commission's current
authority is not adequate to address cyber or other national security
threats to the reliability of our transmission and power system. These
types of threats pose an increasing risk to our Nation's electric grid,
which undergirds our government and economy and helps ensure the health
and welfare of our citizens.
I will describe how limitations in Federal authority do not fully
protect the grid against physical and cyber threats. My testimony also
summarizes the Commission's oversight of the reliability of the
electric grid under section 215 of the Federal Power Act (FPA) and the
Commission's implementation of that authority with respect to cyber
related reliability issues primarily through Order No. 706.
background
In the Energy Policy Act of 2005 (EPAct 2005), Congress entrusted
the Commission with a major new responsibility to oversee mandatory,
enforceable reliability standards for the Nation's bulk power system
(excluding Alaska and Hawaii). This authority is in section 215 of the
Federal Power Act. Section 215 requires the Commission to select an
Electric Reliability Organization (ERO) that is responsible for
proposing, for Commission review and approval, reliability standards or
modifications to existing reliability standards to help protect and
improve the reliability of the Nation's bulk power system. The
Commission has certified the North American Electric Reliability
Corporation (NERC) as the ERO. The reliability standards apply to the
users, owners and operators of the bulk power system and become
mandatory in the United States only after Commission approval. The ERO
also is authorized to impose, after notice and opportunity for a
hearing, penalties for violations of the reliability standards, subject
to Commission review and approval. The ERO may delegate certain
responsibilities to ``Regional Entities,'' subject to Commission
approval.
The Commission may approve proposed reliability standards or
modifications to previously approved standards if it finds them ``just,
reasonable, not unduly discriminatory or preferential, and in the
public interest.'' The Commission itself does not have authority to
modify proposed standards. Rather, if the Commission disapproves a
proposed standard or modification, section 215 requires the Commission
to remand it to the ERO for further consideration. The Commission, upon
its own motion or upon complaint, may direct the ERO to submit a
proposed standard or modification on a specific matter but it does not
have the authority to modify or author a standard and must depend upon
the ERO to do so.
Limitations of Section 215 and the Term ``Bulk Power System''
Currently, the Commission's jurisdiction and reliability authority
is limited to the ``bulk power system,'' as defined in the FPA, and
therefore excludes Alaska and Hawaii, including any federal
installations located therein. The current interpretation of ``bulk
power system'' also excludes some transmission and all local
distribution facilities, including virtually all of the grid facilities
in certain large cities such as New York, thus precluding Commission
action to mitigate cyber or other national security threats to
reliability that involve such facilities and major population areas.
The Commission directed NERC to revise its interpretation of the bulk
power system to eliminate inconsistencies across regions, eliminate the
ambiguity created by the current discretion in NERC's definition of
bulk electric system, provide a backstop review to ensure that any
variations do not compromise reliability, and ensure that facilities
that could significantly affect reliability are subject to mandatory
rules. NERC has recently filed a revised definition of the term bulk
power system, and the Commission has solicited comments on its proposal
to accept NERC's revised definition. However, it is important to note
that section 215 of the FPA excludes local distribution facilities from
the Commission's reliability jurisdiction, so any revised bulk electric
system definition developed by NERC will still not apply to local
distribution facilities.
Critical Infrastructure Protection Reliability Standards
An important part of the Commission's current responsibility to
oversee the development of reliability standards for the bulk power
system involves cyber related reliability issues. In August 2006, NERC
submitted eight proposed cyber standards, known as the Critical
Infrastructure Protection (CIP) standards, to the Commission for
approval under section 215. Critical infrastructure, as defined by NERC
for purposes of the CIP standards, includes facilities, systems, and
equipment which, if destroyed, degraded, or otherwise rendered
unavailable, would affect the reliability or operability of the ``Bulk
Electric System.'' Under NERC's implementation plan for the CIP
standards, full compliance became mandatory on July 1, 2010.
On January 18, 2008, the Commission issued Order No. 706, the Final
Rule approving the CIP reliability standards while concurrently
directing NERC to develop significant modifications addressing specific
concerns. The Commission set a deadline of July 1, 2009 for NERC to
resolve certain issues in the CIP reliability standards, including
deletion of the ``reasonable business judgment'' and ``acceptance of
risk'' language in each of the standards. NERC concluded that this
deadline would create a very compressed schedule for its stakeholder
process. Therefore, it divided all of the changes directed by the
Commission into phases, based on their complexity. NERC opted to
resolve the simplest changes in the first phase, while putting off more
complex changes for later versions.
NERC filed the first phase of the modifications to the CIP
Reliability Standards (Version 2) on May 22, 2009. In this phase, NERC
removed from the standards the terms ``reasonable business judgment''
and ``acceptance of risk,'' added a requirement for a ``single senior
manager'' responsible for CIP compliance, and made certain other
administrative and clarifying changes. In a September 30, 2009 order,
the Commission approved the Version 2 CIP standards and directed NERC
to develop additional modifications to certain of them. Pursuant to the
Commission's September 30, 2009 order, NERC submitted Version 3 of the
CIP standards which revised Version 2 as directed. The Version 3 CIP
standards became effective on October 1, 2010. This first phase of the
modifications directed by the Commission in Order No. 706, which
encompassed both Version 2 and Version 3, did not modify the critical
asset identification process, a central concern in Order No. 706.
On February 10, 2011, NERC initiated the second phase of the Order
No. 706 directed modification, filing a petition seeking approval of
Version 4 of the CIP standards. Version 4 includes new proposed
criteria to identify ``critical assets'' for purposes of the CIP
reliability standards. On April 19, 2012, the Commission issued Order
No. 761, approving the Version 4 CIP standards, which introduced
``bright line'' criteria for the identification of Critical Assets. The
version 4 CIP standards do not go into effect until April 1, 2014. The
currently effective CIP reliability standards allow utilities
significant discretion to determine which of their facilities are
``critical assets and the associated critical cyber assets,'' and
therefore are subject to the requirements of the standards. It is
important to note that although ``critical assets'' are used to
identify subsequent ``critical cyber assets,'' only the subset of
``critical cyber assets''--which are self-determined by the affected
entities--are subject to the CIP standards. As the Commission stated in
Order No. 706, the identification of critical assets is the cornerstone
of the CIP standards. If that identification is not done well, the CIP
standards will be ineffective at maintaining the reliability of the
bulk power system.
In the order approving NERC's Version 4 standards, the Commission
recognized that Version 4 is an interim step and stated its concern
that Version 4 does not provide enough protection to satisfy Order No.
706. Thus, the Commission established a deadline of end of first
quarter of 2013 for NERC to file standards in compliance with the
outstanding directives in Order No. 706.
The remaining CIP standards revisions to respond to the
Commission's directives issued in Order No. 706 are still under
development by NERC. It is important to note that the majority of the
Order No. 706 directed modifications to the CIP standards have yet to
be addressed by NERC. Until they are addressed, there are significant
gaps in protection.
the nerc process
As an initial matter, it is important to recognize how mandatory
reliability standards are established. Under section 215, reliability
standards must be developed by the ERO through an open, inclusive, and
public process. The Commission can direct NERC to develop a reliability
standard to address a particular reliability matter. However, the NERC
process typically requires years to develop standards for the
Commission's review. In fact, the CIP standards approved by the
Commission in January 2008 took approximately three years to develop.
NERC's procedures for developing standards allow extensive
opportunity for stakeholder comment, are open, and are generally based
on the procedures of the American National Standards Institute. The
NERC process is intended to develop consensus on both the need for, and
the substance of, the proposed standard. Although inclusive, the
process is relatively slow, open and unpredictable in its
responsiveness to the Commission's directives. This process requires
public disclosure regarding the reason for the proposed standard, the
manner in which the standard will address the issues, and any
subsequent comments and resulting modifications in the standards as the
affected stakeholders review the material and provide comments. NERC-
approved standards are then submitted to the Commission for its review.
The procedures used by NERC are appropriate for developing and
approving routine reliability standards. The process allows extensive
opportunities for industry and public comment. The public nature of the
reliability standards development process can be a strength of the
process. However, it can be an impediment when measures or actions need
to be taken to address threats to national security quickly,
effectively and in a manner that protects against the disclosure of
security-sensitive information. The current procedures used under
section 215 for the development and approval of reliability standards
do not provide an effective and timely means of addressing urgent cyber
or other national security risks to the bulk power system, particularly
in emergency situations. Certain circumstances, such as those involving
national security, may require immediate action, while the reliability
standard procedures take too long to implement efficient and timely
corrective steps. On September 3, 2010, FERC approved a new reliability
standards process manual filed by NERC. While this manual includes a
process for developing a standard related to a confidential issue, the
new process is untested and it is unclear how the process would be
implemented.
FERC rules governing review and establishment of reliability
standards allow the agency to direct the ERO to develop and propose
reliability standards under an expedited schedule. For example, FERC
could order the ERO to submit a reliability standard to address a
reliability vulnerability within 60 days. Also, NERC's rules of
procedure include a provision for approval of ``urgent action''
standards that can be completed within 60 days and which may be further
expedited by a written finding by the NERC board of trustees that an
extraordinary and immediate threat exists to bulk power system
reliability or national security. However, it is not clear NERC could
meet this schedule in practice. Moreover, faced with a national
security threat to reliability, there may be a need to act decisively
in hours or days, rather than weeks, months or years. That would not be
feasible even under the urgent action process. In the meantime, the
bulk power system would be left vulnerable to a known national security
threat. Moreover, existing procedures, including the urgent action
procedure, could widely publicize both the vulnerability and the
proposed solutions, thus increasing the risk of hostile actions before
the appropriate solutions are implemented.
In addition, a reliability standard submitted to the Commission by
NERC may not be sufficient to address the identified vulnerability or
threat. Since FERC may not directly modify a proposed reliability
standard under section 215 and must either approve or remand it, FERC
would have the choice of approving an inadequate standard and directing
changes, which reinitiates a process that can take years, or rejecting
the standard altogether. Under either approach, the bulk power system
would remain vulnerable for a prolonged period.
This concern was highlighted in the Department of Energy Inspector
General's January 2011 audit report on FERC's ``Monitoring of Power
Grid Cyber Security.'' The audit report identified concerns regarding
the adequacy of the CIP standards and the implementation and schedule
for the CIP standards, and concluded that these problems exist, in
part, because the Commission's authority to ensure adequate reliability
of the bulk electric system is limited. This report emphasizes the need
for additional authority to ensure adequate cyber security over the
bulk electric system.
Finally, the open and inclusive process required for standards
development is not consistent with the need to protect security-
sensitive information. For instance, a formal request for a new
standard would normally detail the need for the standard as well as the
proposed mitigation to address the issue, and the NERC-approved version
of the standard would be filed with the Commission for review. This
public information could help potential adversaries in planning
attacks.
physical security and other threats to reliability
The existing reliability standards do not extend to physical
threats to the grid, but physical threats can cause equal or greater
destruction than cyber attacks and the Federal government should have
no less ability to act to protect against such potential damage. One
example of a physical threat is an electromagnetic pulse (EMP) event.
EMP events can be generated from either naturally occurring or man-made
causes. In the case of the former, solar magnetic disturbances
periodically disrupt the earth's magnetic field which in turn, can
generate large induced ground currents. This effect, also termed the
``E3'' component of an EMP, can simultaneously damage or destroy bulk
power system transformers over a large geographic area. Regarding man-
made events, EMP can also be generated by weapons. Equipment and plans
are readily available that have the capability to generate high-energy
bursts, termed ``E1'', that can damage or destroy electronics such as
those found in control and communication systems on the power grid.
These devices can be portable and effective, facilitating simultaneous
coordinated attacks, and can be reused, allowing use against multiple
targets. The most comprehensive man-made EMP threat is from a high-
altitude nuclear explosion. It would affect an area defined by the
``line-of-sight'' from the point of detonation. The higher the
detonation the larger the area affected, and the more powerful the
explosion the stronger the EMP emitted. The first component of the
resulting pulse E1 occurs within a fraction of a second and can destroy
control and communication electronics. The second component is termed
``E2'' and is similar to lightning, which is well-known and mitigated
by industry. Toward the end of an EMP event, a third element, E3,
occurs. This causes the same effect as solar magnetic disturbances. It
can damage or destroy power transformers connected to long transmission
lines. It is important to note that effective mitigation against solar
magnetic disturbances and non-nuclear EMP weaponry provides effective
mitigation against a high-altitude nuclear explosion.
In 2001, Congress established a commission to assess the threat
from EMP, with particular attention to be paid to the nature and
magnitude of high-altitude EMP threats to the United States;
vulnerabilities of U.S. military and civilian infrastructure to such
attack; capabilities to recover from an attack; and the feasibility and
cost of protecting military and civilian infrastructure, including
energy infrastructure. In 2004, the EMP commission issued a report
describing the nature of EMP attacks, vulnerabilities to EMP attacks,
and strategies to respond to an attack.\1\ A second report was produced
in 2008 that further investigated vulnerabilities of the Nation's
infrastructure to EMP.\2\ Both electrical equipment and control systems
can be damaged by EMP.
---------------------------------------------------------------------------
\1\ Graham, Dr. William R. et al., Report of the Commission to
Assess the Threat to the United States from Electromagnetic Pulse (EMP)
Attack (2004).
\2\ Dr. John S. Foster, Jr. et al., Report of the Commission to
Assess the Threat to the United States from Electromagnetic Pulse (EMP)
Attack (2008).
---------------------------------------------------------------------------
An EMP may also be a naturally-occurring event caused by solar
flares and storms disrupting the Earth's magnetic field. In 1859, a
major solar storm occurred, causing auroral displays and significant
shifts of the Earth's magnetic fields. As a result, telegraphs were
rendered useless and several telegraph stations burned down. The
impacts of that storm were muted because semiconductor technology did
not exist at the time. Were the storm to happen today, according to an
article in Scientific American, it could ``severely damage satellites,
disable radio communications, and cause continent-wide electrical
black-outs that would require weeks or longer to recover from.''\3\
Although storms of this magnitude occur rarely, storms and flares of
lesser intensity occur more frequently. Storms of about half the
intensity of the 1859 storm occur every 50 years or so according to the
authors of the Scientific American article, and the last such storm
occurred in November 1960, leading to world-wide geomagnetic
disturbances and radio outages. The power grid is particularly
vulnerable to solar storms, as transformers are electrically grounded
to the Earth and susceptible to damage from geomagnetically induced
currents. The damage or destruction of numerous transformers across the
country would result in reduced grid functionality and even prolonged
power outages.
---------------------------------------------------------------------------
\3\ Odenwald, Sten F. and Green, James L., Bracing the Satellite
Infrastructure for a Solar Superstorm, Scientific American Magazine
(Jul. 28, 2008).
---------------------------------------------------------------------------
In March 2010, Oak Ridge National Laboratory (Oak Ridge) and their
subcontractor Metatech released a study that explored the vulnerability
of the electric grid to EMP-related events. This study was a joint
effort contracted by FERC staff, the Department of Energy and the
Department of Homeland Security and expanded on the information
developed in other initiatives, including the EMP commission reports.
The series of reports provided detailed technical background and
outlined which sections of the power grid are most vulnerable, what
equipment would be affected, and what damage could result. Protection
concepts for each threat and additional methods for remediation were
also included along with suggestions for mitigation. The results of the
study support the general conclusion that EMP events pose substantial
risk to equipment and operation of the Nation's power grid and under
extreme conditions could result in major long term electrical outages.
In fact, solar magnetic disturbances are inevitable with only the
timing and magnitude subject to variability. The study assessed the
1921 solar storm, which has been termed a 1-in-100 year event, and
applied it to today's power grid. The study concluded that such a storm
could damage or destroy up to 300 bulk power system transformers
interrupting service to 130 million people for a period of years.
On April 30, 2012, the Commission held a technical conference to
discuss issues related to reliability of the bulk power system as
affected by geomagnetic disturbances. The conference explored the risks
and impacts from geomagnetically induced currents to transformers and
other equipment on the bulk power system, as well as options for
addressing or mitigating the risks and impacts. The Commission is
considering the comments filed after that conference.
The existing reliability standards do not address EMP
vulnerabilities. Protecting the electric generation, transmission and
distribution systems from severe damage due to an EMP-related event
would involve vulnerability assessments at every level of electric
infrastructure.
the need for legislation
In my view, section 215 of the Federal Power Act provides an
adequate statutory foundation for the ERO to develop most reliability
standards for the bulk power system. However, the nature of a national
security threat by entities intent on attacking the U.S. through
vulnerabilities in its electric grid stands in stark contrast to other
major reliability vulnerabilities that have caused regional blackouts
and reliability failures in the past, such as vegetation management and
protective relay maintenance practices. Widespread disruption of
electric service can quickly undermine the U.S. government, its
military, and the economy, as well as endanger the health and safety of
millions of citizens. Given the national security dimension to this
threat, there may be a need to act quickly to protect the grid, to act
in a manner where action is mandatory rather than voluntary, and to
protect certain information from public disclosure.
The Commission's current legal authority is inadequate for such
action. This is true of both cyber and physical threats to the bulk
power system that pose national security concerns. Section 215 of the
FPA excludes all facilities in Alaska and Hawaii and all local
distribution facilities from the Commission's reliability jurisdiction,
which may leave significant facilities vulnerable to the threat of a
cyber or physical attack. In addition, although the NERC standards
development process as envisioned in section 215 can be fine for
routine reliability matters, it is too slow, too open and too
unpredictable to ensure its responsiveness in the cases where national
security is endangered. This process is inadequate when measures or
actions need to be taken to address threats to national security
quickly, effectively and in a manner that protects against the
disclosure of security-sensitive information.
These shortcomings can be solved through a comprehensive,
government-wide approach to cyber security issues or through a sector-
specific approach. If a government-wide course is pursued, care should
be taken to ensure that the two approaches complement each other,
preserving FERC's ability to regulate electric reliability effectively.
Any new legislation should address several key concerns. First, to
prevent a significant risk of disruption to the grid, legislation
should allow the federal government to take action before a cyber or
physical national security incident has occurred. In particular, the
federal government should be able to require mitigation even before or
while NERC and its stakeholders develop a standard, when circumstances
require urgent action. Second, any legislation should ensure
appropriate confidentiality of sensitive information submitted,
developed or issued under this authority. Without such confidentiality,
the grid may be more vulnerable to attack. Third, if additional
reliability authority is limited to the bulk power system, as that term
is currently defined in the FPA, it would not authorize Federal action
to mitigate cyber or other national security threats to reliability
that involve certain critical facilities and major population areas.
Fourth, it is important that entities be able to recover costs they
incur to mitigate vulnerabilities and threats.
conclusion
The Commission's current authority is not adequate to address cyber
or other national security threats to the reliability of our
transmission and power system. These types of threats pose an
increasing risk to our Nation's electric grid, which undergirds our
government and economy and helps ensure the health and welfare of our
citizens. Thank you again for the opportunity to testify today. I would
be happy to answer any questions you may have.
The Chairman. Thank you very much.
Mr. Wilshusen, go right ahead.
STATEMENT OF GREGORY C. WILSHUSEN, DIRECTOR, INFORMATION AND
TECHNOLOGY, GOVERNMENT ACCOUNTABILITY OFFICE
Mr. Wilshusen. Mr. Chairman, Ranking Member Murkowski,
members of the committee. Thank you for the opportunity to
testify at today's hearing on actions to secure the electricity
grid.
As you know, the electric power industry, which is composed
of electricity generation, transmission, distribution, and
system operations, is increasingly incorporating information
technology systems and networks into its existing
infrastructure, as it modernizes the electricity grid.
The use of IT can provide many benefits, such as greater
efficiency and reliability, and lower costs to consumers.
However, this increased reliance on computer systems and
networks also introduces cyber-based risk to the grid if the
systems and networks are not properly protected.
For nearly a decade, GAO has identified the protection of
systems supporting our Nation's critical infrastructure, which
includes the electricity grid, as a Government-wide, high risk
area.
Today, I will discuss the cyber threats to the electricity
grid and several of the actions taken and challenges remaining
to secure the grid. But, first, if I may, Mr. Chairman, I would
like to recognize several members of my team who were
instrumental in developing this statement and also conducting
the work on which it is based.
With me today is Anjalique Lawrence, seated behind me. Back
at the office: Mike Gilmore, Lee McCracken, David Trimble, Jon
Ludwigson, and Paige Gilbreath, all played significant roles
and made significant contributions.
Mr. Chairman, the threats to systems supporting the
electricity grid are evolving and growing. They include both
unintentional and intentional threats, and may come in the form
of equipment failures, as well as targeted and untargeted
attacks from our adversaries.
The interconnectivity between industrial control systems,
computer networks, and the Internet can amplify the impact of
these threats and expose the grid to known and unknown
cybersecurity vulnerabilities, potentially affecting the
operations of critical infrastructures, the security of
sensitive information, and the flow of commerce. Several
reported incidents illustrate the potentially serious impact of
these threats.
To address such concerns, State and Federal authorities
play key roles in overseeing grid reliability, which involves
the security of the grid. State regulators generally oversee
the reliability of local distribution system; whereas, NERC has
developed and enforced mandatory standards intended to ensure
the reliability of the bulk power system, which includes
certain generation facilities and the high voltage electricity
transmission network.
FERC has approved and, thus, made mandatory, 8 critical
infrastructure standards developed by NERC to help ensure the
secure electronic exchange of information and to prevent
unauthorized physical and logical access to critical cyber
assets.
In addition, NIST has identified guidelines on how to
securely implement smart grid systems and identified an initial
set of interoperability and cybersecurity standards for the
smart grid. However, FERC has not yet adopted these standards,
citing a lack of consensus for them.
GAO has previously reported on a number of key challenges
to securing the modernized electricity grid; for example,
aspects of current regulatory environment may complicate
matters. Specifically, jurisdictional issues and the
difficulties associated with responding to continually evolving
cyber threats were a key regulatory challenge to ensuring the
cybersecurity of the grid.
We also reported other challenges affecting industry
efforts to secure the smart grid. Specifically, the electricity
industry had not consistently built security features for
certain smart grid devices, established an effective mechanism
for sharing cybersecurity information, and created a set of
metrics for evaluating the effectiveness of cybersecurity
controls.
GAO has made several recommendations to FERC aimed at
addressing these challenges and the Commission has agreed with
these recommendations.
In summary, Mr. Chairman, the evolving and growing threat
from cyber-based attacks highlights the importance of securing
the electricity industry's systems and networks. A successful
attack could result in wide-spread power outages, significant
monetary losses, and extensive property damage.
More needs to be done to meet the challenges facing the
industry and enhancing security. In particular, Federal
regulators and other stakeholders will need to work closely
together with the private sector, to address cybersecurity
challenges, as the generation, transmission, and distribution
of electricity come to rely more on emerging and sophisticated
technologies.
Mr. Chairman, Ranking Member, this completes my statement.
I would be happy to answer any questions.
[The prepared statement of Mr. Wilshusen follows:]
Prepared Statement of Gregory C. Wilshusen, Director, Information and
Technology, Government Accountability Office
why gao did this study
The electric power industry is increasingly incorporating
information technology (IT) systems and networks into its existing
infrastructure (e.g., electricity networks, including power lines and
customer meters). This use of IT can provide many benefits, such as
greater efficiency and lower costs to consumers. However, this
increased reliance on IT systems and networks also exposes the grid to
cybersecurity vulnerabilities, which can be exploited by attackers.
Moreover, GAO has identified protecting systems supporting our nation's
critical infrastructure (which includes the electricity grid) as a
governmentwide high-risk area.
GAO was asked to testify on the status of actions to protect the
electricity grid from cyber attacks. Accordingly, this statement
discusses (1) cyber threats facing cyber-reliant critical
infrastructures, which include the electricity grid, and (2) actions
taken and challenges remaining to secure the grid against cyber
attacks. In preparing this statement, GAO relied on previously
published work in this area and reviewed reports from other federal
agencies, media reports, and other publicly available sources.
what gao recommends
In a prior report, GAO has made recommendations related to
electricity grid modernization efforts, including developing an
approach to monitor compliance with voluntary standards. These
recommendations have not yet been implemented.
what gao found
The threats to systems supporting critical infrastructures are
evolving and growing. In testimony, the Director of National
Intelligence noted a dramatic increase in cyber activity targeting U.S.
computers and systems, including a more than tripling of the volume of
malicious software. Varying types of threats from numerous sources can
adversely affect computers, software, networks, organizations, entire
industries, and the Internet itself. These include both unintentional
and intentional threats, and may come in the form of targeted or
untargeted attacks from criminal groups, hackers, disgruntled
employees, nations, or terrorists. The interconnectivity between
information systems, the Internet, and other infrastructures can
amplify the impact of these threats, potentially affecting the
operations of critical infrastructures, the security of sensitive
information, and the flow of commerce. Moreover, the electricity grid's
reliance on IT systems and networks exposes it to potential and known
cybersecurity vulnerabilities, which could be exploited by attackers.
The potential impact of such attacks has been illustrated by a number
of recently reported incidents and can include fraudulent activities,
damage to electricity control systems, power outages, and failures in
safety equipment.
To address such concerns, multiple entities have taken steps to
help secure the electricity grid, including the North American Electric
Reliability Corporation, the National Institute of Standards and
Technology (NIST), the Federal Energy Regulatory Commission, and the
Departments of Homeland Security and Energy. These include, in
particular, establishing mandatory and voluntary cybersecurity
standards and guidance for use by entities in the electricity industry.
For example, the North American Electric Reliability Corporation and
the Federal Energy Regulatory Commission, which have responsibility for
regulation and oversight of part of the industry, have developed and
approved mandatory cybersecurity standards and additional guidance. In
addition, NIST has identified cybersecurity standards that support
smart grid interoperability and has issued a cybersecurity guideline.
The Departments of Homeland Security and Energy have also played roles
in disseminating guidance on security practices and providing other
assistance.
As GAO previously reported, there were a number of ongoing
challenges to securing electricity systems and networks. These include:
A lack of a coordinated approach to monitor industry
compliance with voluntary standards.
Aspects of the current regulatory environment made it
difficult to ensure the cybersecurity of smart grid systems.
A focus by utilities on regulatory compliance instead of
comprehensive security.
A lack of security features consistently built into smart
grid systems.
The electricity industry did not have an effective mechanism
for sharing information on cybersecurity and other issues.
The electricity industry did not have metrics for evaluating
cybersecurity.
Chairman Bingaman, Ranking Member Murkowski, and Members of the
Committee:
Thank you for the opportunity to testify at today's hearing on the
status of actions to protect the electricity grid from cyber attacks.
As you know, the electric power industry is increasingly
incorporating information technology (IT) systems and networks into its
existing infrastructure (e.g., electricity networks including power
lines and customer meters). This use of IT can provide many benefits,
such as greater efficiency and lower costs to consumers. Along with
these anticipated benefits, however, cybersecurity and industry experts
have expressed concern that, if not implemented securely, modernized
electricity grid systems will be vulnerable to attacks that could
result in widespread loss of electrical services essential to
maintaining our national economy and security.
In addition, since 2003 we have identified protecting systems
supporting our nation's critical infrastructure (which includes the
electricity grid) as a governmentwide high-risk area, and we continue
to do so in the most recent update to our high-risk list.\1\
---------------------------------------------------------------------------
\1\ GAO's biennial high-risk list identifies government programs
that have greater vulnerability to fraud, waste, abuse, and
mismanagement or need transformation to address economy, efficiency, or
effectiveness challenges. We have designated federal information
security as a governmentwide high-risk area since 1997; in 2003, we
expanded this high-risk area to include protecting systems supporting
our nation's critical infrastructure--referred to as cyber-critical
infrastructure protection, or cyber CIP. See, most recently, GAO, High-
Risk Series: An Update, GAO-11-278 (Washington, D.C.: February 2011).
---------------------------------------------------------------------------
In my testimony today, I will describe (1) cyber threats facing
cyber-reliant critical infrastructures,\2\ which include the
electricity grid, and (2) actions taken and challenges remaining to
secure the grid against cyber attacks. In preparing this statement in
July 2012, we relied on our previous work in this area, including
studies examining efforts to secure the electricity grid and associated
challenges and cybersecurity guidance.\3\ (Please see the related GAO
products in appendix I.) The products upon which this statement is
based contain detailed overviews of the scope of our reviews and the
methodology we used. We also reviewed documents from the Federal Energy
Regulatory Commission, the North American Electric Reliability
Corporation, the Department of Energy, including its Office of the
Inspector General, and the Department of Homeland Security Industrial
Control Systems Cyber Emergency Response Team, as well as publicly
available reports on cyber incidents. The work on which this statement
is based was performed in accordance with generally accepted government
auditing standards. Those standards require that we plan and perform
audits to obtain sufficient, appropriate evidence to provide a
reasonable basis for our findings and conclusions. We believe that the
evidence obtained provided a reasonable basis for our findings and
conclusions based on our audit objectives.
---------------------------------------------------------------------------
\2\ Federal policy established 18 critical infrastructure sectors.
These include, for example, banking and finance, communications, public
health, and energy. The energy sector includes subsectors for oil and
gas and for electricity.
\3\ GAO, Critical Infrastructure Protection: Cybersecurity Guidance
Is Available, but More Can Be Done to Promote Its Use, GAO-12-92
(Washington, D.C.: Dec. 9, 2011), and Electricity Grid Modernization:
Progress Being Made on Cybersecurity Guidelines, but Key Challenges
Remain to be Addressed, GAO-11-117 (Washington, D.C.: Jan. 12, 2011).
---------------------------------------------------------------------------
background
The electricity industry, as shown in figure 1, is composed of four
distinct functions: generation, transmission, distribution, and system
operations. Once electricity is generated--whether by burning fossil
fuels; through nuclear fission; or by harnessing wind, solar,
geothermal, or hydro energy--it is generally sent through high-voltage,
high-capacity transmission lines to local electricity distributors.
Once there, electricity is transformed into a lower voltage and sent
through local distribution lines for consumption by industrial plants,
businesses, and residential consumers. Because electric energy is
generated and consumed almost instantaneously, the operation of an
electric power system requires that a system operator constantly
balance the generation and consumption of power.
Utilities own and operate electricity assets, which may include
generation plants, transmission lines, distribution lines, and
substations--structures often seen in residential and commercial areas
that contain technical equipment such as switches and transformers to
ensure smooth, safe flow of current and regulate voltage. Utilities may
be owned by investors, municipalities, and individuals (as in
cooperative utilities). System operators--sometimes affiliated with a
particular utility or sometimes independent and responsible for
multiple utility areas--manage the electricity flows. These system
operators manage and control the generation, transmission, and
distribution of electric power using control systems--IT-and network-
based systems that monitor and control sensitive processes and physical
functions, including opening and closing circuit breakers.\4\ As we
have previously reported, the effective functioning of the electricity
industry is highly dependent on these control systems.\5\ However, for
many years, aspects of the electricity network lacked (1) adequate
technologies--such as sensors--to allow system operators to monitor how
much electricity was flowing on distribution lines, (2) communications
networks to further integrate parts of the electricity grid with
control centers, and (3) computerized control devices to automate
system management and recovery.
---------------------------------------------------------------------------
\4\ Circuit breakers are devices used to open or close electric
circuits. If a transmission or distribution line is in trouble, a
circuit breaker can disconnect it from the rest of the system.
\5\ GAO, Critical Infrastructure Protection: Multiple Efforts to
Secure Control Systems Are Under Way, but Challenges Remain, GAO-07-
1036 (Washington, D.C.: Sept. 10, 2007).
---------------------------------------------------------------------------
modernization of the electricity infrastructure
As the electricity industry has matured and technology has
advanced, utilities have begun taking steps to update the electricity
grid--the transmission and distribution systems--by integrating new
technologies and additional IT systems and networks. Though utilities
have regularly taken such steps in the past, industry and government
stakeholders have begun to articulate a broader, more integrated vision
for transforming the electricity grid into one that is more reliable
and efficient; facilitates alternative forms of generation, including
renewable energy; and gives consumers real-time information about
fluctuating energy costs.
This vision--the smart grid--would increase the use of IT systems
and networks and two-way communication to automate actions that system
operators formerly had to make manually. Electricity grid modernization
is an ongoing process, and initiatives have commonly involved
installing advanced metering infrastructure (smart meters) on homes and
commercial buildings that enable two-way communication between the
utility and customer. Other initiatives include adding ``smart''
components to provide the system operator with more detailed data on
the conditions of the transmission and distribution systems and better
tools to observe the overall condition of the grid (referred to as
``wide-area situational awareness''). These include advanced, smart
switches on the distribution system that communicate with each other to
reroute electricity around a troubled line and high-resolution, time-
synchronized monitors--called phasor measurement units--on the
transmission system.
The use of smart grid systems may have a number of benefits,
including improved reliability from fewer and shorter outages, downward
pressure on electricity rates resulting from the ability to shift peak
demand, an improved ability to shift to alternative sources of energy,
and an improved ability to detect and respond to potential attacks on
the grid.
regulation of the electricity industry
Both the federal government and state governments have authority
for overseeing the electricity industry. For example, the Federal
Energy Regulatory Commission (FERC) regulates rates for wholesale
electricity sales and transmission of electricity in interstate
commerce. This includes approving whether to allow utilities to recover
the costs of investments they make to the transmission system, such as
smart grid investments. Meanwhile, local distribution and retail sales
of electricity are generally subject to regulation by state public
utility commissions.
State and federal authorities also play key roles in overseeing the
reliability of the electric grid. State regulators generally have
authority to oversee the reliability of the local distribution system.
The North American Electric Reliability Corporation (NERC) is the
federally designated U.S. Electric Reliability Organization, and is
overseen by FERC. NERC has responsibility for conducting reliability
assessments and developing and enforcing mandatory standards to ensure
the reliability of the bulk power system--i.e., facilities and control
systems necessary for operating the transmission network and certain
generation facilities needed for reliability. NERC develops reliability
standards collaboratively through a deliberative process involving
utilities and others in the industry, which are then sent to FERC for
approval. These standards include critical infrastructure protection
standards for protecting electric utility-critical and cyber-critical
assets. FERC has responsibility for reviewing and approving the
reliability standards or directing NERC to modify them.
In addition, the Energy Independence and Security Act of 2007\6\
established federal policy to support the modernization of the
electricity grid and required actions by a number of federal agencies,
including the National Institute of Standards and Technology (NIST),
FERC, and the Department of Energy. With regard to cybersecurity, the
act required NIST and FERC to take the following actions:
---------------------------------------------------------------------------
\6\ Pub. L. No. 110-140 (Dec. 19, 2007).
NISTwas to coordinate development of a framework that
includes protocols and model standards for information
management to achieve interoperability of smart grid devices
and systems. As part of its efforts to accomplish this, NIST
planned to identify cybersecurity standards for these systems
and also identified the need to develop guidelines for
organizations such as electric companies on how to securely
implement smart grid systems. In January 2011,\7\ we reported
that NIST had identified 11 standards involving cybersecurity
that support smart grid interoperability and had issued a first
version of a cybersecurity guideline.\8\
---------------------------------------------------------------------------
\7\ GAO-11-117.
\8\ NIST Special Publication 1108, NIST Framework and Roadmap for
Smart Grid Interoperability Standards, Release 1.0, January 2010 and
NIST Interagency Report 7628, Guidelines for Smart Grid Cyber Security,
August 2010.
---------------------------------------------------------------------------
FERC was to adopt standards resulting from NIST's efforts
that it deemed necessary to ensure smart grid functionality and
interoperability. However, according to FERC officials, the
statute did not provide specific additional authority to allow
FERC to require utilities or manufacturers of smart grid
technologies to follow these standards. As a result, any
standards identified and developed through the NIST-led process
are voluntary unless regulators use other authorities to
indirectly compel utilities and manufacturers to follow them.
the electricity grid is potentially vulnerable to an evolving array of
cyber-based threats
Threats to systems supporting critical infrastructure--which
includes the electricity industry and its transmission and distribution
systems--are evolving and growing. In February 2011, the Director of
National Intelligence testified that, in the past year, there had been
a dramatic increase in malicious cyber activity targeting U.S.
computers and networks, including a more than tripling of the volume of
malicious software since 2009.\9\ Different types of cyber threats from
numerous sources may adversely affect computers, software, networks,
organizations, entire industries, or the Internet. Cyber threats can be
unintentional or intentional. Unintentional threats can be caused by
software upgrades or maintenance procedures that inadvertently disrupt
systems. Intentional threats include both targeted and untargeted
attacks from a variety of sources, including criminal groups, hackers,
disgruntled employees, foreign nations engaged in espionage and
information warfare, and terrorists. Table 1 shows common sources of
cyber threats.
---------------------------------------------------------------------------
\9\ Director of National Intelligence, Statement for the Record on
the Worldwide Threat Assessment of the U.S. Intelligence Community,
statement before the Senate Select Committee on Intelligence (Feb. 16,
2011).
TABLE 1: SOURCES OF CYBERSECURITY THREATS
------------------------------------------------------------------------
Threat source Description
------------------------------------------------------------------------
Bot-network operators Bot-net operators use a
network, or bot-net, of
compromised, remotely
controlled systems to
coordinate attacks and to
distribute phishing schemes,
spam, and malware attacks.
The services of these
networks are sometimes made
available on underground
markets (e.g., purchasing a
denial-of-service attack or
services to relay spam or
phishing attacks).
------------------------------------------------------------------------
Criminal groups Criminal groups seek to
attack systems for monetary
gain. Specifically,
organized criminal groups
use spam, phishing, and
spyware/malware to commit
identity theft, online
fraud, and computer
extortion. International
corporate spies and criminal
organizations also pose a
threat to the United States
through their ability to
conduct industrial espionage
and large-scale monetary
theft and to hire or develop
hacker talent.
------------------------------------------------------------------------
Hackers Hackers break into networks
for the thrill of the
challenge, bragging rights
in the hacker community,
revenge, stalking, monetary
gain, and political
activism, among other
reasons. While gaining
unauthorized access once
required a fair amount of
skill or computer knowledge,
hackers can now download
attack scripts and protocols
from the Internet and launch
them against victim sites.
Thus, while attack tools
have become more
sophisticated, they have
also become easier to use.
According to the Central
Intelligence Agency, the
large majority of hackers do
not have the requisite
expertise to threaten
difficult targets such as
critical U.S. networks.
Nevertheless, the worldwide
population of hackers poses
a relatively high threat of
an isolated or brief
disruption causing serious
damage.
------------------------------------------------------------------------
Insiders The disgruntled organization
insider is a principal
source of computer crime.
Insiders may not need a
great deal of knowledge
about computer intrusions
because their knowledge of a
target system often allows
them to gain unrestricted
access to cause damage to
the system or to steal
system data. The insider
threat includes contractors
hired by the organization,
as well as careless or
poorly trained employees who
may inadvertently introduce
malware into systems.
------------------------------------------------------------------------
Nations Nations use cyber tools as
part of their information-
gathering and espionage
activities. In addition,
several nations are
aggressively working to
develop information warfare
doctrine, programs, and
capabilities. Such
capabilities enable a single
entity to have a significant
and serious impact by
disrupting the supply,
communications, and economic
infrastructures that support
military power--impacts that
could affect the daily lives
of citizens across the
country. In his January 2012
testimony, the Director of
National Intelligence stated
that, among state actors,
China and Russia are of
particular concern.
------------------------------------------------------------------------
Phishers Individuals or small groups
execute phishing schemes in
an attempt to steal
identities or information
for monetary gain. Phishers
may also use spam and
spyware or malware to
accomplish their objectives.
------------------------------------------------------------------------
Spammers Individuals or organizations
distribute unsolicited e-
mail with hidden or false
information in order to sell
products, conduct phishing
schemes, distribute spyware
or malware, or attack
organizations (e.g., a
denial of service).
------------------------------------------------------------------------
Spyware or malware authors Individuals or organizations
with malicious intent carry
out attacks against users by
producing and distributing
spyware and malware. Several
destructive computer viruses
and worms have harmed files
and hard drives, including
the Melissa Macro Virus, the
Explore.Zip worm, the CIH
(Chernobyl) Virus, Nimda,
Code Red, Slammer, and
Blaster.
------------------------------------------------------------------------
Terrorists Terrorists seek to destroy,
incapacitate, or exploit
critical infrastructures in
order to threaten national
security, cause mass
casualties, weaken the
economy, and damage public
morale and confidence.
Terrorists may use phishing
schemes or spyware/malware
in order to generate funds
or gather sensitive
information.
------------------------------------------------------------------------
Source: GAO analysis based on data from the Director of National
Intelligence, Department of Justice, Central Intelligence Agency, and
the Software Engineering Institute's CERT Coordination Center.
These sources of cyber threats make use of various techniques, or
exploits that may adversely affect computers, software, a network, an
organization's operation, an industry, or the Internet itself. Table 2
shows common types of cyber exploits.
TABLE 2: TYPES OF CYBER EXPLOITS
------------------------------------------------------------------------
Type of exploit Description
------------------------------------------------------------------------
Cross-site scripting An attack that uses third-
party web resources to run
script within the victim's
web browser or scriptable
application. This occurs
when a browser visits a
malicious website or clicks
a malicious link. The most
dangerous consequences occur
when this method is used to
exploit additional
vulnerabilities that may
permit an attacker to steal
cookies (data exchanged
between a web server and a
browser), log key strokes,
capture screen shots,
discover and collect network
information, and remotely
access and control the
victim's machine.
------------------------------------------------------------------------
Denial-of-service An attack that prevents or
impairs the authorized use
of networks, systems, or
applications by exhausting
resources.
------------------------------------------------------------------------
Distributed denial-of-service A variant of the denial-of-
service attack that uses
numerous hosts to perform
the attack.
------------------------------------------------------------------------
Logic bombs A piece of programming code
intentionally inserted into
a software system that will
cause a malicious function
to occur when one or more
specified conditions are
met.
------------------------------------------------------------------------
Phishing A digital form of social
engineering that uses
authentic-looking, but fake,
e-mails to request
information from users or
direct them to a fake
website that requests
information.
------------------------------------------------------------------------
Passive wiretapping The monitoring or recording
of data, such as passwords
transmitted in clear text,
while they are being
transmitted over a
communications link. This is
done without altering or
affecting the data.
------------------------------------------------------------------------
Structured Query Language (SQL) injection An attack that involves the
alteration of a database
search in a web-based
application, which can be
used to obtain unauthorized
access to sensitive
information in a database.
------------------------------------------------------------------------
Trojan horse A computer program that
appears to have a useful
function, but also has a
hidden and potentially
malicious function that
evades security mechanisms
by, for example,
masquerading as a useful
program that a user would
likely execute.
------------------------------------------------------------------------
Virus A computer program that can
copy itself and infect a
computer without the
permission or knowledge of
the user. A virus might
corrupt or delete data on a
computer, use e-mail
programs to spread itself to
other computers, or even
erase everything on a hard
disk. Unlike a computer
worm, a virus requires human
involvement (usually
unwitting) to propagate.
------------------------------------------------------------------------
War driving The method of driving through
cities and neighborhoods
with a wireless-equipped
computer--sometimes with a
powerful antenna--searching
for unsecured wireless
networks.
------------------------------------------------------------------------
Worm A self-replicating, self-
propagating, self-contained
program that uses network
mechanisms to spread itself.
Unlike computer viruses,
worms do not require human
involvement to propagate.
------------------------------------------------------------------------
Zero-day exploit An exploit that takes
advantage of a security
vulnerability previously
unknown to the general
public. In many cases, the
exploit code is written by
the same person who
discovered the
vulnerability. By writing an
exploit for the previously
unknown vulnerability, the
attacker creates a potent
threat since the compressed
timeframe between public
discoveries of both makes it
difficult to defend against
------------------------------------------------------------------------
Source: GAO analysis of data from the National Institute of Standards
and Technology, United States Computer Emergency Readiness Team, and
industry reports.
electricity grid faces cybersecurity vulnerabilities
The potential impact of these threats is amplified by the
connectivity between information systems, the Internet, and other
infrastructures, creating opportunities for attackers to disrupt
critical services, including electrical power. In addition, the
increased reliance on IT systems and networks also exposes the electric
grid to potential and known cybersecurity vulnerabilities. These
vulnerabilities include
an increased number of entry points and paths that can be
exploited by potential adversaries and other unauthorized
users;
the introduction of new, unknown vulnerabilities due to an
increased use of new system and network technologies;
wider access to systems and networks due to increased
connectivity; and
an increased amount of customer information being collected
and transmitted, providing incentives for adversaries to attack
these systems and potentially putting private information at
risk of unauthorized disclosure and use.
In May 2008, we reported that the corporate network of the
Tennessee Valley Authority--the nation's largest public power company,
which generates and distributes power in an area of about 80,000 square
miles in the southeastern United States--contained security weaknesses
that could lead to the disruption of control systems networks and
devices connected to that network.\10\ We made 19 recommendations to
improve the implementation of information security program activities
for the control systems governing the Tennessee Valley Authority's
critical infrastructures and 73 recommendations to address specific
weaknesses in security controls. The Tennessee Valley Authority
concurred with the recommendations and has taken steps to implement
them.
---------------------------------------------------------------------------
\10\ GAO, Information Security: TVA Needs to Address Weaknesses in
Control Systems and Networks, GAO-08-526 (Washington, D.C.: May 21,
2008).
---------------------------------------------------------------------------
We and others have also reported that smart grid and related
systems have known cyber vulnerabilities. For example, cybersecurity
experts have demonstrated that certain smart meters can be successfully
attacked, possibly resulting in disruption to the electricity grid. In
addition, we have reported that control systems used in industrial
settings such as electricity generation have vulnerabilities that could
result in serious damages and disruption if exploited.\11\ Further, in
2007, the Department of Homeland Security, in cooperation with the
Department of Energy, ran a test that demonstrated that a vulnerability
commonly referred to as ``Aurora'' had the potential to allow
unauthorized users to remotely control, misuse, and cause damage to a
small commercial electric generator. Moreover, in 2008, the Central
Intelligence Agency reported that malicious activities against IT
systems and networks have caused disruption of electric power
capabilities in multiple regions overseas, including a case that
resulted in a multicity power outage.\12\ As government, private
sector, and personal activities continue to move to networked
operations, the threat will continue to grow.
---------------------------------------------------------------------------
\11\ GAO-07-1036.
\12\ The White House, Cyberspace Policy Review: Assuring a Trusted
and Resilient Information and Communications Infrastructure
(Washington, D.C.: May 29, 2009).
---------------------------------------------------------------------------
reported incidents illustrate the potential impact of cyber threats
Cyber incidents continue to affect the electricity industry. For
example, the Department of Homeland Security's Industrial Control
Systems Cyber Emergency Response Team recently noted that the number of
reported cyber incidents affecting control systems of companies in the
electricity sector increased from 3 in 2009 to 25 in 2011. In addition,
we and others have reported\13\ that cyber incidents can affect the
operations of energy facilities, as the following examples illustrate:
---------------------------------------------------------------------------
\13\ GAO-07-1036 and GAO-12-92.
Smart meter attacks.--In April 2012, it was reported that
sometime in 2009 an electric utility asked the FBI to help it
investigate widespread incidents of power thefts through its
smart meter deployment. The report indicated that the
miscreants hacked into the smart meters to change the power
consumption recording settings using software available on the
Internet.
Phishing attacks directed at energy sector.--The Department
of Homeland Security's Industrial Control Systems Cyber
Emergency Response Team reported that, in 2011, it deployed
incident response teams to an electric bulk provider and an
electric utility that had been victims of broader phishing
attacks. The team found three malware samples and detected
evidence of a sophisticated threat actor.
Stuxnet.--In July 2010, a sophisticated computer attack
known as Stuxnet was discovered. It targeted control systems
used to operate industrial processes in the energy, nuclear,
and other critical sectors. It is designed to exploit a
combination of vulnerabilities to gain access to its target and
modify code to change the process.
Browns Ferry power plant.--In August 2006, two circulation
pumps at Unit 3 of the Browns Ferry, Alabama, nuclear power
plant failed, forcing the unit to be shut down manually. The
failure of the pumps was traced to excessive traffic on the
control system network, possibly caused by the failure of
another control system device.
Northeast power blackout.--In August 2003, failure of the
alarm processor in the control system of FirstEnergy, an Ohio-
based electric utility, prevented control room operators from
having adequate situational awareness of critical operational
changes to the electrical grid. When several key transmission
lines in northern Ohio tripped due to contact with trees, they
initiated a cascading failure of 508 generating units at 265
power plants across eight states and a Canadian province.
Davis-Besse power plant.--The Nuclear Regulatory Commission
confirmed that in January 2003, the Microsoft SQL Server worm
known as Slammer infected a private computer network at the
idled Davis-Besse nuclear power plant in Oak Harbor, Ohio,
disabling a safety monitoring system for nearly 5 hours. In
addition, the plant's process computer failed, and it took
about 6 hours for it to become available again.
actions have been taken to secure the electricity grid, but challenges
remain
Multiple entities have taken steps to help secure the electricity
grid, including NERC, NIST, FERC, and the Departments of Homeland
Security and Energy. NERC has performed several activities that are
intended to secure the grid. It has developed eight critical
infrastructure standards for protecting electric utility-critical and
cyber-critical assets.
The standards established requirements for the following key
cybersecurity-related controls: critical cyber asset identification,
security management controls, personnel and training, electronic
``security perimeters,'' physical security of critical cyber assets,
systems security management, incident reporting and response planning,
and recovery plans for critical cyber assets. In December 2011, we
reported that NERC's eight cyber security standards, along with
supplementary documents, were substantially similar to NIST guidance
applicable to federal agencies.\14\
---------------------------------------------------------------------------
\14\ GAO-12-92.
---------------------------------------------------------------------------
NERC also has published security guidelines for companies to
consider for protecting electric infrastructure systems, although such
guidelines are voluntary and typically not checked for compliance. For
example, NERC's June 2010 Security Guideline for the Electricity
Sector: Identifying Critical Cyber Assets is intended to assist
entities in identifying and developing a list of critical cyber assets
as described in the mandatory standards. NERC also has enforced
compliance with mandatory cybersecurity standards through its
Compliance Monitoring and Enforcement Program, subject to FERC review.
NERC has assessed monetary penalties for violations of its cyber
security standards.
NIST, in implementing its responsibilities under the Energy
Independence and Security Act of 2007 with regard to standards to
achieve interoperability of smart grid systems, planned to identify
cybersecurity standards for these systems. In January 2011, we
reported\15\ that it had identified 11 standards involving
cybersecurity that support smart grid interoperability and had issued a
first version of a cybersecurity guideline.\16\ NIST's cybersecurity
guidelines largely addressed key cybersecurity elements, such as
assessment of cybersecurity risks and identification of security
requirements (i.e., controls); however, its guidelines did not address
an important element essential to securing smart grid systems--the risk
of attacks using both cyber and physical means.\17\ NIST officials said
that they intended to update the guidelines to address this and other
missing elements they identified, but their plan and schedule for doing
so were still in draft form. We recommended that NIST finalize its plan
and schedule for incorporating missing elements, and NIST officials
agreed. We are currently working with officials to determine the status
of their efforts to address these recommendations.
---------------------------------------------------------------------------
\15\ GAO-11-117.
\16\ NIST Special Publication 1108, NIST Framework and Roadmap for
Smart Grid Interoperability Standards, Release 1.0, January 2010 and
NIST Interagency Report 7628, Guidelines for Smart Grid Cyber Security,
August 2010.
\17\ GAO-11-117.
---------------------------------------------------------------------------
FERC also has taken several actions to help secure the electricity
grid. For example, it reviewed and approved NERC's eight critical
infrastructure protection standards in 2008. Since then, in its role of
overseeing the development of reliability standards, the commission has
directed NERC to make numerous changes to standards to improve
cybersecurity protections. However, according to the FERC Chairman's
February 2012 letter in response to our report on electricity grid
modernization, many of the outstanding directives have not been
incorporated into the latest versions of the standards. The Chairman
added that the commission would continue to work with NERC to
incorporate the directives. In addition, FERC has authorized NERC to
enforce mandatory reliability standards for the bulk power system,
while retaining its authority to enforce the same standards and assess
penalties for violations. We reported in January 2011 that FERC also
had begun reviewing initial smart grid standards identified as part of
NIST efforts. However, in July 2011, the commission declined to adopt
the initial smart grid standards identified as a part of the NIST
efforts, finding that there was insufficient consensus to do so.
The Department of Homeland Security has been designated by federal
policy as the principal federal agency to lead, integrate, and
coordinate the implementation of efforts to protect cyber-critical
infrastructures and key resources. Under this role, the Department's
National Cyber Security Division's Control Systems Security Program has
issued recommended practices to reduce risks to industrial control
systems within and across all critical infrastructure and key resources
sectors, including the electricity subsector. For example, in April
2011, the program issued the Catalog of Control Systems Security:
Recommendations for Standards Developers, which is intended to provide
a detailed listing of recommended controls from several standards
related to control systems.\18\ The program also manages and operates
the Industrial Control Systems Cyber Emergency Response Team to respond
to and analyze control-systems-related incidents, provide onsite
support for incident response and forensic analysis, provide
situational awareness in the form of actionable intelligence, and share
and coordinate vulnerability information and threat analysis through
information products and alerts. For example, it reported providing on-
site assistance to six companies in the electricity subsector,
including a bulk electric power provider and multiple electric
utilities, during 2009-2011.
---------------------------------------------------------------------------
\18\ DHS, National Cyber Security Division, Control Systems
Security Program, Catalog of Control Systems Security: Recommendations
for Standards Developers (April 2011).
---------------------------------------------------------------------------
The Department of Energy is the lead federal agency which is
responsible for coordinating critical infrastructure protection efforts
with the public and private stakeholders in the energy sector,
including the electricity subsector. In this regard, we have reported
that officials from the Department's Office of Electricity Delivery and
Energy Reliability stated that the department was involved in efforts
to assist the electricity sector in the development, assessment, and
sharing of cybersecurity standards.\19\ For example, the department was
working with NIST to enable state power producers to use current
cybersecurity guidance. In May 2012, the department released the
Electricity Subsector Cybersecurity Risk Management Process.\20\ The
guideline is intended to ensure that cybersecurity risks for the
electric grid are addressed at the organization, mission or business
process, and information system levels. We have not evaluated this
guide.
---------------------------------------------------------------------------
\19\ GAO-12-92.
\20\ U.S. Department of Energy, Electricity Subsector Cybersecurity
Risk Management Process, DOE/OE-0003 (Washington, D.C.: May 2012).
---------------------------------------------------------------------------
challenges to securing electricity systems and networks
In our January 2011 report, we identified a number of key
challenges that industry and government stakeholders faced in ensuring
the cybersecurity of the systems and networks that support our nation's
electricity grid.\21\ These included the following:
---------------------------------------------------------------------------
\21\ GAO-11-117.
There was a lack of a coordinated approach to monitor
whether industry follows voluntary standards.--As mentioned
above, under the Energy Independence and Security Act of 2007,
FERC is responsible for adopting cybersecurity and other
standards that it deems necessary to ensure smart grid
functionality and interoperability. However, FERC had not
developed an approach coordinated with other regulators to
monitor, at a high level, the extent to which industry will
follow the voluntary smart grid standards it adopts. There had
been initial efforts by regulators to share views, through, for
example, a collaborative dialogue between FERC and the National
Association of Regulatory Utility Commissioners, which had
discussed the standards-setting process in general terms.
Nevertheless, according to officials from FERC and the National
Association of Regulatory Utility Commissioners, FERC and the
state public utility commissions had not established a joint
approach for monitoring how widely voluntary smart grid
standards are followed in the electricity industry or developed
strategies for addressing any gaps. Moreover, FERC had not
coordinated in such a way with groups representing public power
or cooperative utilities, which are not routinely subject to
FERC's or the states' regulatory jurisdiction for rate setting.
We noted that without a good understanding of whether utilities
and manufacturers are following smart grid standards, it would
be difficult for FERC and other regulators to know whether a
voluntary approach to standards setting is effective or if
changes are needed.\22\
---------------------------------------------------------------------------
\22\ In an order issued on July 19, 2011, FERC reported that it had
found insufficient consensus to institute a rulemaking proceeding to
adopt smart grid interoperability standards identified by NIST as ready
for consideration by regulatory authorities. While FERC dismissed the
rulemaking, it encouraged utilities, smart grid product manufacturers,
regulators, and other smart grid stakeholders to actively participate
in the NIST interoperability framework process to work on the
development of interoperability standards and to refer to that process
for guidance on smart grid standards. Despite this result, we believe
our recommendations to FERC in GAO-11-117, with which FERC concurred,
remain valid and should be acted upon as consensus is reached and
standards adopted.
---------------------------------------------------------------------------
Aspects of the current regulatory environment made it
difficult to ensure the cybersecurity of smart grid systems.--
In particular, jurisdictional issues and the difficulties
associated with responding to continually evolving cyber
threats were a key regulatory challenge to ensuring the
cybersecurity of smart grid systems as they are deployed.
Regarding jurisdiction, experts we spoke with expressed concern
that there was a lack of clarity about the division of
responsibility between federal and state regulators,
particularly regarding cybersecurity. While jurisdictional
responsibility has historically been determined by whether a
technology is located on the transmission or distribution
system, experts raised concerns that smart grid technology may
blur these lines. For example, devices such as smart meters
deployed on parts of the grid traditionally subject to state
jurisdiction could, in the aggregate, have an impact on those
parts of the grid that federal regulators are responsible for--
namely the reliability of the transmission system.
There was also concern about the ability of regulatory bodies to
respond to evolving cybersecurity threats. For example, one
expert questioned the ability of government agencies to adapt
to rapidly evolving threats, while another highlighted the need
for regulations to be capable of responding to the evolving
cybersecurity issues. In addition, our experts expressed
concern with agencies developing regulations in the future that
are overly specific in their requirements, such as those
specifying the use of a particular product or technology.
Consequently, unless steps are taken to mitigate these
challenges, regulations may not be fully effective in
protecting smart grid technology from cybersecurity threats.
Utilities were focusing on regulatory compliance instead of
comprehensive security.--The existing federal and state
regulatory environment creates a culture within the utility
industry of focusing on compliance with cybersecurity
requirements, instead of a culture focused on achieving
comprehensive and effective cybersecurity. Specifically,
experts told us that utilities focus on achieving minimum
regulatory requirements rather than designing a comprehensive
approach to system security. In addition, one expert stated
that security requirements are inherently incomplete, and
having a culture that views the security problem as being
solved once those requirements are met will leave an
organization vulnerable to cyber attack. Consequently, without
a comprehensive approach to security, utilities leave
themselves open to unnecessary risk.
There was a lack of security features built into smart grid
systems. Security features are not consistently built into
smart grid devices.--For example, experts told us that certain
currently available smart meters had not been designed with a
strong security architecture and lacked important security
features, including event logging\23\ and forensics
capabilities that are needed to detect and analyze attacks. In
addition, our experts stated that smart grid home area
networks--used for managing the electricity usage of appliances
and other devices in the home--did not have adequate security
built in, thus increasing their vulnerability to attack.
Without securely designed smart grid systems, utilities may
lack the capability to detect and analyze attacks, increasing
the risk that attacks will succeed and utilities will be unable
to prevent them from recurring.
---------------------------------------------------------------------------
\23\ Event logging is a capability of an IT system to record events
occurring within an organization's systems and networks, including
those related to computer security.
---------------------------------------------------------------------------
The electricity industry did not have an effective mechanism
for sharing information on cybersecurity and other issues.--The
electricity industry lacked an effective mechanism to disclose
information about cybersecurity vulnerabilities, incidents,
threats, lessons learned, and best practices in the industry.
For example, our experts stated that while the electricity
industry has an information sharing center, it did not fully
address these information needs. In addition, President Obama's
May 2009 cyberspace policy review also identified challenges
related to cybersecurity information sharing within the
electric and other critical infrastructure sectors and issued
recommendations to address them.\24\ According to our experts,
information regarding incidents such as both unsuccessful and
successful attacks must be able to be shared in a safe and
secure way to avoid publicly revealing the reported
organization and penalizing entities actively engaged in
corrective action. Such information sharing across the industry
could provide important information regarding the level of
attempted cyber attacks and their methods, which could help
grid operators better defend against them. If the industry
pursued this end, it could draw upon the practices and
approaches of other industries when designing an industry-led
approach to cybersecurity information sharing. Without quality
processes for information sharing, utilities will not have the
information needed to adequately protect their assets against
attackers.
---------------------------------------------------------------------------
\24\ The White House, Cyberspace Policy Review: Assuring a Trusted
and Resilient Information and Communications Infrastructure
(Washington, D.C.: May 29, 2009).
---------------------------------------------------------------------------
The electricity industry did not have metrics for evaluating
cybersecurity.--The electricity industry was also challenged by
a lack of cybersecurity metrics, making it difficult to measure
the extent to which investments in cybersecurity improve the
security of smart grid systems. Experts noted that while such
metrics\25\ are difficult to develop, they could help compare
the effectiveness of competing solutions and determine what mix
of solutions combine to make the most secure system.
Furthermore, our experts said that having metrics would help
utilities develop a business case for cybersecurity by helping
to show the return on a particular investment. Until such
metrics are developed, there is increased risk that utilities
will not invest in security in a cost-effective manner, or have
the information needed to make informed decisions on their
cybersecurity investments.
---------------------------------------------------------------------------
\25\ Metrics can be used for, among other things, measuring the
effectiveness of cybersecurity controls for detecting and blocking
cyber attacks.
To address these challenges, we made recommendations in our January
2011 report. To improve coordination among regulators and help Congress
better assess the effectiveness of the voluntary smart grid standards
process, we recommended that the Chairman of FERC develop an approach
to coordinate with state regulators and with groups that represent
utilities subject to less FERC and state regulation to (1) periodically
evaluate the extent to which utilities and manufacturers are following
voluntary interoperability and cybersecurity standards and (2) develop
strategies for addressing any gaps in compliance with standards that
are identified as a result of this evaluation. We also recommended that
FERC, working with NERC as appropriate, assess whether commission
efforts should address any of the cybersecurity challenges identified
in our report. FERC agreed with these recommendations.
Although FERC agreed with these recommendations, they have not yet
been implemented. According to the FERC Chairman, given the continuing
evolution of standards and the lack of sufficient consensus for
regulatory adoption, commission staff believe that coordinated
monitoring of compliance with standards would be premature at this
time, and that this may change as new standards are developed and
deployed in industry. We believe that it is still important for FERC to
improve coordination among regulators and that consensus is reached on
standards. We will continue to monitor the status of its efforts to
address these recommendations.
In summary, the evolving and growing threat from cyber-based
attacks highlights the importance of securing the electricity
industry's systems and networks. A successful attack could result in
widespread power outages, significant monetary costs, damage to
property, and loss of life. The roles of NERC and FERC remain critical
in approving and disseminating cybersecurity guidance and enforcing
standards, as appropriate. Moreover, more needs to be done to meet
challenges facing the industry in enhancing security, particularly as
the generation, transmission, and distribution of electricity comes to
rely more on emerging and sophisticated technology.
Chairman Bingaman, Ranking Member Murkowski, and Members of the
Committee, this concludes my statement. I would be happy to answer any
questions you may have at this time.
appendix i: related gao products
Cybersecurity: Threats Impacting the Nation. GAO-12-666T.
Washington, D.C.: April 24, 2012.
Cybersecurity: Challenges in Securing the Modernized Electricity
Grid, GAO-12-507T. Washington, D.C.: February 28, 2012.
Critical Infrastructure Protection: Cybersecurity Guidance Is
Available, but More Can Be Done to Promote Its Use. GAO-12-92.
Washington, D.C.: December 9, 2011.
High-Risk Series: An Update. GAO-11-278. Washington, D.C.: February
2011.
Electricity Grid Modernization: Progress Being Made on
Cybersecurity Guidelines, but Key Challenges Remain to Be Addressed.
GAO-11-117. Washington, D.C.: January 12, 2011.
Cybersecurity: Continued Attention Needed to Protect Our Nation's
Critical Infrastructure. GAO-11-865T. Washington, D.C.: July 26, 2011.
Critical Infrastructure Protection: Key Private and Public Cyber
Expectations Need to Be Consistently Addressed. GAO-10-628. Washington,
D.C.: July 15, 2010.
Cyberspace: United States Faces Challenges in Addressing Global
Cybersecurity and Governance. GAO-10-606. Washington, D.C.: July 2,
2010.
Cybersecurity: Continued Attention Is Needed to Protect Federal
Information Systems from Evolving Threats. GAO-10-834T. Washington,
D.C.: June 16, 2010.
Critical Infrastructure Protection: Update to National
Infrastructure Protection Plan Includes Increased Emphasis on Risk
Management and Resilience. GAO-10-296. Washington, D.C.: March 5, 2010.
Cybersecurity: Progress Made but Challenges Remain in Defining and
Coordinating the Comprehensive National Initiative. GAO-10-338.
Washington, D.C.: March 5, 2010.
Cybersecurity: Continued Efforts Are Needed to Protect Information
Systems from Evolving Threats. GAO-10-230T. Washington, D.C.: November
17, 2009.
Defense Critical Infrastructure: Actions Needed to Improve the
Identification and Management of Electrical Power Risks and
Vulnerabilities to DOD Critical Assets. GAO-10-147. Washington, D.C.:
October 23, 2009.
Critical Infrastructure Protection: Current Cyber Sector-Specific
Planning Approach Needs Reassessment. GAO-09-969. Washington, D.C.:
September 24, 2009.
National Cybersecurity Strategy: Key Improvements Are Needed to
Strengthen the Nation's Posture. GAO-09-432T. Washington, D.C.: March
10, 2009.
Electricity Restructuring: FERC Could Take Additional Steps to
Analyze Regional Transmission Organizations' Benefits and Performance.
GAO-08-987. Washington, D.C.: September 22, 2008.
Information Security: TVA Needs to Address Weaknesses in Control
Systems and Networks. GAO-08-526. Washington, D.C.: May 21, 2008.
Critical Infrastructure Protection: Multiple Efforts to Secure
Control Systems Are Under Way, but Challenges Remain. GAO-07-1036.
Washington, D.C.: September 10, 2007.
Cybercrime: Public and Private Entities Face Challenges in
Addressing Cyber Threats. GAO-07-705. Washington, D.C.: June 22, 2007.
Meeting Energy Demand in the 21st Century: Many Challenges and Key
Questions. GAO-05-414T. Washington, D.C.: March 16, 2005.
The Chairman. Thank you very much.
Mr. Cauley.
STATEMENT OF GERRY CAULEY, PRESIDENT AND CHIEF EXECUTIVE
OFFICER, NORTH AMERICAN ELECTRIC RELIABILITY CORPORATION
Mr. Cauley. Thank you, and good morning, Chairman Bingaman,
and Ranking Member Murkowski, and members of the committee, and
fellow panelists. My name is Gerry Cauley. I am the President
and CEO of the North American Electric Reliability Corporation.
When we go about our business for reliability and security
of the power grid, we think, first, of the customers and rate
payers and citizens that we serve. When I do that, we think
about 4 principles. First of all, focus on really big important
reliability problems find solutions, and fix them.
Second, we apply principles of using risk-based approaches
to make sure that we are prioritizing effectively and that we
are coming up with cost-effective solutions.
Third, we focus on the learning industry. So, we are
continually adapting and developing reliability solutions and
learning from experience.
Finally, we hold the industry accountable, as well as
ourselves, to produce reliability results.
This approach works really well in conventional risks, such
as storm outages, equipment failures, human factors, errors,
and those kinds of things. I think the approach also works well
in the arena of cyber and physical security.
One of the big differences, however, in security is we are
often challenged by the lack of information, and this is where,
in cyber, the partnership between industry and Government, in
terms of information sharing, to help us understand those risks
and be able to adapt to them, is very important.
So, our strategy for security recognizes that a perfect
defense against the bad guys is not achievable nor necessarily
affordable. So what we have to do is combine defense
strategies, such as through our standards, as well as
resilience, and adapting and enhancing the existing resilience
of the bulk power system.
So, our strategy includes several activities. The first is
in the--having a base set of standards that ensure the
protection of the grid. We promote and are involved in active
information sharing between industry and Government, and among
industry, and among critical infrastructure sectors. We are
focused on training and exercising and testing our ability to
perform well under security challenges. We are continually
assessing the reliability and security of the system, looking
at emerging issues and emerging threats. We are working with
Government agencies to develop solutions for security and also
addressing cross-sector dependencies.
I did previously testify in front of the committee in May
2011, and I would just like to briefly review some of the
changes and some of the activities that we have completed since
that time.
First, in the area of standards--and I appreciate the
Chairman pointing out that the electric power industry and the
nuclear power industries are the only two critical
infrastructures that do have mandatory standards and
enforceable standards that are in place and that are working.
It was mentioned that we--the Commission just recently
approved version 4, which includes a bright-line criteria, in
terms of which facilities are required to be included within
those standards. We are currently working on what I believe
will be a plateau of security for us in version 5, where we are
adopting NIST's risk controls into our standards, and we will
have those completed and filed with the Commission by the end
of the first quarter in 2013.
In addition to the standards, we also have a very rigorous
program on compliance. Since 2008, we have conducted over 500
audits of individual companies, sending teams onsite, finding
various findings and recommendations and things that need to be
corrected. We also have the industry under a very aggressive
program to monitor the remediation of those issues.
A third area is in the area of information sharing and
analysis. This is our way of addressing near-term issues and
risks that emerge continuously. There is a parallel that--if
you look at--Microsoft essentially publishes on the second
Tuesday of each month for patches and vulnerabilities that have
been identified over the previous month. That is essentially an
approach that we need to take in terms of emerging risks and
threats that come in that might be--need to be addressed on a
matter of hours or days.
We use our information sharing process, issue alerts. We
were able to get an agreement signed with Homeland Security to
gain us access to the National Cybersecurity and Communications
Integration Center, the NCCIC, and we have a secure portal up
and running that allows the sharing of information. We have got
over 500 companies that are actively engaging, in terms of
posting and using that information. Our alerts that we're able
to issue go to all 1,900 companies that are affected by the
bulk power system.
Another area where we work actively is in the area of
partnering with Federal partners. We have developed best
practices guidelines, based on NIS practices with Department of
Energy. We also worked on the White House Initiative to develop
a risk management maturity model, and we recently issued 4
reports on resilience, severe cyber attack, and GMD.
So, in conclusion, I think our framework of standards,
information sharing, and partnering with Government is the
approach that will be most successful in cybersecurity.
Thank you.
[The prepared statement of Mr. Cauley follows:]
Prepared Statement of Gerry Cauley, President and Chief Executive
Officer, North American Electric Reliability Corporation
introduction
Good morning Chairman Bingaman, Ranking Member Murkowski, members
of the Committee and fellow panelists. My name is Gerry Cauley and I am
the President and CEO of the North American Electric Reliability
Corporation (NERC). NERC was designated the Electric Reliability
Organization (ERO) by the Federal Energy Regulatory Commission (FERC)
in accordance with Section 215 of the Federal Power Act (FPA), enacted
by the Energy Policy Act of 2005. NERC's reliability standards are
mandatory and enforceable within the US for the bulk power system and
include Critical Infrastructure Protection (CIP) Standards. To date,
these standards (and those promulgated by the Nuclear Regulatory
Commission) are the only mandatory cybersecurity standards in place
across the critical infrastructures of the United States. NERC's
mission is to ensure the reliability of the bulk power system of North
America and promote reliability excellence with accountability for
standards and compliance, risks to reliability and continued
coordination and collaboration with public and private sector partners.
I testified on this subject before this Committee in May 2011, and I
appreciate the opportunity to update the Committee on NERC's activities
related to cybersecurity. These activities include, but are not limited
to:
1. Receiving FERC approval of NERC's Critical Cyber Asset
Identification standards (CIP-002 version 4);
2. Beginning work on a comprehensive revision to the
cybersecurity standards, leveraging lessons learned from
previous versions;
3. Issuing eight additional alerts related to cybersecurity
concerns;
4. Developing a risk management process guideline to help
utilities better understand their cybersecurity risks, assess
severity, and allocate resources more efficiently to manage
those risks;
5. Completing the first phase of the High-Impact Low-
Frequency Task Force reports identifying recommendations for
owners and operators with respect to addressing severe impact
resilience, cyber attacks, spare equipment, and geomagnetic
disruptions;
6. Facilitating the first-ever Grid Security Exercise
(GridEx) for the Electricity Sub-sector in North America; and
7. Participating in government partnership initiatives,
including the Department of Homeland Security's (DHS) National
Level Exercise series and various cybersecurity forums and
briefings with Canadian government agencies, as well as the
White House-initiated, Department of Energy (DOE)-led
Electricity Sub-sector Cybersecurity Risk Management Maturity
Model, which will support ongoing development and measurement
of cybersecurity capabilities within the sub-sector;
the cybersecurity challenge for the grid
As a result of society's growing dependence on electricity, the
electric grid is one of the Nation's most critical infrastructures. The
bulk power system in North America is one of the largest, most complex,
and most robust systems ever created. As CEO of the organization
charged with ensuring the reliability and security of the North
American grid, I remain deeply concerned about the changing risk
landscape from conventional risks, such as extreme weather and
equipment failures, to new and emerging risks where we are left to
imagine scenarios that might occur and prepare to avoid or mitigate the
consequences. Some of those consequences could be much more severe than
we have previously experienced. I am most concerned about coordinated
physical and cyber attacks intended to disable elements of the power
grid or deny electricity to specific targets, such as government or
business centers, military installations, or other infrastructures.
These threats differ from conventional risks in that they result from
intentional actions by adversaries and are not simply random failures
or acts of nature.
To explore the impacts of this changing risk landscape from the
view of the newer emerging risks, NERC has worked with industry and
government to better understand cybersecurity risks and manage those
risks. Based on all of the work NERC has been involved in to date, it
is clear that the most effective approach against adversaries
exploiting the newer risk landscape is through thoughtful application
of resiliency principles. Resiliency requires proactive readiness for
whatever may come our way and includes robustness; the ability to
minimize consequences in real-time; the ability to restore essential
services; and the ability to adapt and learn.
nerc measures to address cybersecurity threats and vulnerabilities
NERC has incorporated these resiliency elements in our strategic
approach to ensuring reliability of the bulk power system. This
strategic approach includes: 1) developing mandatory and enforceable
standards; 2) ensuring compliance and audit oversight; 3) sharing and
analyzing information and issuing Alerts from the Electricity Sector
Information Sharing and Analysis Center (ES-ISAC); 4) engaging in
private-public partnerships; and 5) conducting outreach, training, and
education activities within and external to the bulk power system. Only
through these critical infrastructure protection components can we
achieve a balanced approach to guard against advanced persistent
threats to grid cybersecurity and mitigate vulnerabilities.
reliability standards
In 2007, FERC designated NERC the ERO in accordance with Section
215 of the Federal Power Act, enacted by the Energy Policy Act of 2005.
Upon FERC's approval, NERC's reliability standards became mandatory
within the US. These mandatory reliability standards include CIP
Standards 001 through 009, which address the security of cyber assets
essential to the reliable operation of the electric grid. To date,
these standards (and those promulgated by the Nuclear Regulatory
Commission) are the only mandatory cybersecurity standards in place
across the critical infrastructures of the US. Subject to FERC
oversight, NERC and its Regional Entity partners enforce these
standards, developed with substantial input from industry and approved
by FERC, to accomplish our mission to ensure the reliability of the
electric grid.
NERC's nine mandatory CIP standards address the following areas:
Standard CIP-001: Covers Sabotage Reporting.
Standard CIP-002: Requires the identification and
documentation of the Critical Cyber Assets associated with the
Critical Assets that support the reliable operation of the Bulk
Electric System.
Standard CIP-003: Requires that Responsible Entities have
minimum security management controls in place to protect
Critical Cyber Assets.
Standard CIP-004: Requires that personnel with access having
authorized cyber or authorized unescorted physical access to
Critical Cyber Assets, including contractors and service
vendors, have an appropriate level of personnel risk
assessment, training, and security awareness.
Standard CIP-005: Requires the identification and protection
of the Electronic Security Perimeter(s) inside which all
Critical Cyber Assets reside, as well as all access points on
the perimeter.
Standard CIP-006: Addresses implementation of a physical
security program for the protection of Critical Cyber Assets.
Standard CIP-007: Requires Responsible Entities to define
methods, processes, and procedures for securing those systems
determined to be Critical Cyber Assets, as well as the other
(non-critical) Cyber Assets within the Electronic Security
Perimeter(s).
Standard CIP-008: Ensures the identification,
classification, response, and reporting of Cyber Security
Incidents related to Critical Cyber Assets.
Standard CIP-009: Ensures that recovery plan(s) are put in
place for Critical Cyber Assets and that these plans follow
established business continuity and disaster recovery
techniques and practices.
In December 2010, NERC approved an enhancement to its Critical
Cyber Asset Identification standard (CIP-002 version 4) that
establishes bright-line criteria for the identification of critical
assets. This enhanced standard was filed with the Federal Energy
Regulatory Commission (FERC) in February 2011, and FERC approved the
standard on April 19, 2012. The implementation of the CIP standards
under the bright-line approach is currently underway.
In addition, industry is currently developing a comprehensive
revision to the cybersecurity Standards. The revision leverages
experience with existing CIP standards to enhance the industry's
protections against cyber threats and vulnerabilities, including
transitioning the classification of critical assets to a ``low-medium-
high'' impact-based system. The revised CIP standards will also provide
greater flexibility in implementing solutions to emerging cyber
threats. The revised CIP standards have been improved to remove
technology-specific requirements by replacing them with a risk-based
approach to implementing appropriate and changing technologies. That
is, rather than specifying how to implement a requirement, the revised
requirements specify the risk-based result that must be achieved, which
enables industry to implement new and emerging technologies to address
the risk.
NERC can use an emergency standards development process if
circumstances warrant. In addition, FERC can order NERC to develop or
modify a reliability standard to address a specific matter.\1\ Finally,
the NERC Board of Trustees can direct NERC to develop and adopt a
standard in response to a FERC directive and timetable if the Board
determines that the regular standards process is not sufficiently
responsive to the Commission.
---------------------------------------------------------------------------
\1\ FERC can order NERC to develop a proposed reliability standard
or a modification to a reliability standard to address a specific
matter (such as a cyber threat or vulnerability) under FPA Section
215(d) (5).
---------------------------------------------------------------------------
Under the emergency standards process, FERC has authorized NERC to
use an expedited standards development process to meet urgent
reliability issues. These special standards can be developed on an
expedited, confidential basis to address imminent or longer-term
national security threats. NERC has practiced using this expedited,
confidential process as part of GridEx.
In addition to developing mandatory reliability standards, NERC
supports the ERO's Regional Entities to improve the consistency of
compliance program results, improve risk-based approaches for auditing
and spot checking, and promote a culture of security and compliance
through education, transparency, and incentives. Specifically, we
conduct audit oversight of the Regional Entities' compliance audit
teams during audits of registered entities, and maintain oversight
throughout the entire audit process (pre-audit, on-site, and post
audit) in accordance with the audit oversight program. During this
process, NERC seeks to capture compliance applications, positive
observations, lessons learned, and recommendations. NERC's audit
oversights are designed to perform a thorough evaluation of the
processes and criteria used by all Regional Entities in their
determination of registered entities' compliance with the NERC
Reliability Standards, including the CIP Standards.
Compliance with the NERC CIP standards is an important threshold
for properly securing the bulk electric system. However, no single
security asset, technique, procedure, or standard--even if strictly
followed--will protect an entity from all potential cyber threats. The
cybersecurity threat environment is constantly changing and our
defenses must keep pace. Security best-practices call for additional
processes, procedures, and technologies beyond those required by the
CIP standards.
the es-isac and nerc alerts
Not all vulnerabilities can or should be addressed through a
reliability standard. In such cases, NERC Alerts are a key element in
critical infrastructure protection. To address cyber challenges not
covered under the CIP Standards, NERC works through its ES-ISAC to
inform the industry and recommend mitigation actions.
The ES-ISAC gathers information from disparate electric industry
participants about security-related events, disturbances, and off-
normal occurrences within the Electricity Sub-sector and shares that
information with key governmental entities. In turn, these governmental
entities provide the ES-ISAC with information regarding risks, threats,
and warnings which the ES-ISAC is then responsible for disseminating
throughout the Electricity Sub-sector. The two functions that the ES-
ISAC supports, information sharing and analytics, are vitally important
to all other critical infrastructures and key resource sectors that
have active ISACs. Effective collaboration and communication is
essential to addressing infrastructure protection and resilience within
each sector, as well as the important interdependencies that exist
among sectors.
NERC staff with appropriate security clearances often work with
cleared personnel from Federal agencies to communicate unclassified
sensitive information to the industry. As defined in NERC's Rules of
Procedure, the ES-ISAC developed the following three levels of Alerts
for formal notice to industry regarding security issues:
Industry Advisory.--Purely informational, intended to alert
registered entities to issues or potential problems. A response
to NERC is not necessary.
Recommendation to Industry.--Recommends specific action be
taken by registered entities. Requires a response from
recipients as defined in the Alert.
Essential Action.--Identifies actions deemed to be
``essential'' to bulk power system reliability and requires
NERC Board of Trustees approval prior to issuance. Like
recommendations, essential actions require recipients to
respond as defined in the Alert.
The risk to the bulk power system determines selection of the
appropriate Alert notification level. Generally, NERC distributes
Alerts broadly to users, owners, and operators of the bulk power system
in North America utilizing its Compliance Registry. Entities registered
with NERC are required to provide and maintain up-to-date compliance
and cyber security contacts. NERC also distributes the Alerts beyond
the users, owners and operators of the bulk power system, to include
other electricity industry participants who need the information.
Alerts may also be targeted to groups of entities based on their NERC-
registered functions (e.g., Balancing Authorities, Transmission
Operators, Generation Owners, etc.).
Alerts are developed with the strong partnership of Federal
technical organizations, including DHS and DOE National Laboratories,
and bulk power system subject matter experts, called the HYDRA team.
NERC has issued 22 CIP-related Alerts since January 2010 (20 Industry
Advisories and two Recommendations to Industry). Those Alerts covered
items such as Aurora, Stuxnet, Night Dragon, and the reporting of
suspicious activity. Responses to Alerts and mitigation efforts are
identified and tracked, with follow-up provided to individual owners
and operators and key stakeholders. In addition, NERC released one
Joint Product CIP Awareness Bulletin in collaboration with DOE, DHS and
the Federal Bureau of Investigation (FBI) titled, ``Remote Access
Attacks: Advanced Attackers Compromise Virtual Private Networks
(VPN).''
The NERC Alert system is working well. It is known by industry,
handles confidential information, and does so in an expedited manner.
The information needed to develop the Alert is managed in a
confidential and expedited manner and does not require a NERC balloting
process. Information sharing through the ES-ISAC is the greatest asset
we have to combat emerging threats to cybersecurity and help ensure the
reliability of the bulk power system. As a result, NERC has been
enhancing the ES-ISAC's capabilities by building out a private, secure
portal to receive voluntary reports from industry members and working
with various organizations (both industry and government) to obtain the
data and mechanisms necessary to conduct these information sharing
activities.
Anything Congress can do to further facilitate information sharing
between the public and private sector would add greatly to these
efforts. Some actions may include: making more clearances available to
industry, identifying alternative methods to communicate classified
information to our Canadian partners, and encouraging increased
information sharing by US Government departments and agencies with
asset-owners.
nerc's public-private partnerships to enhance grid cybersecurity
As mentioned, NERC has developed several strong relationships with
industry and government entities. As chair of the Electricity Sub-
sector Coordinating Council (ESCC), I work with industry CEOs and our
partners within the government, including the Department of Defense,
DOE, and DHS, to identify, discuss, and resolve critical infrastructure
protection policy, process, and resource issues. This type of public-
private partnership is essential to effective cybersecurity protection
by facilitating information sharing about cyber-related vulnerabilities
and threats.
Last year, NERC signed a Cooperative Research and Development
Agreement with DHS that provides ES-ISAC staff with access to DHS'
National Cybersecurity and Communications Integration Center (NCCIC).
Access to the classified NCCIC facilitates a significantly improved bi-
directional sharing of critical infrastructure protection information
between the US government and the Electricity Sub-sector in North
America. NERC has also recently established a protected communications
corridor for the ES-ISAC in part to facilitate this bi-directional
information sharing between the DHS NCCIC and BPS entities.
NERC also provides leadership to three significant DHS-affiliated
public-private partnerships. These groups are:
Partnership for Critical Infrastructure Security, the
senior-most policy coordination group between public and
private sector organizations comprised of the chairs or co-
chairs of all 18 critical infrastructure and key resources
sectors and their Government Coordinating Council counterparts;
Cross-Sector Cyber Security Working Group, which was
established to coordinate cross-sector initiatives that promote
public and private efforts to help ensure secure, safe, and
reliable critical infrastructure services; and
Industrial Control Systems Joint Working Group, which is a
cross-sector industrial control systems working group that
focuses on the areas of education, cross-sector strategic
roadmap development, and coordinated efforts to develop better
vendor focus on security needs for industrial control systems.
NERC also collaborates with the Industrial Control Systems Cyber
Emergency Response Team to share threat, vulnerability, and security
incident information.
As part of NERC's outreach and awareness efforts to engage industry
and government in addressing some of the key cybersecurity challenges
we face, NERC facilitated the first-ever Grid Security Exercise
(GridEx) for the Electricity Sub-sector in North America. This
distributed play exercise, which was held in November 2011, was
designed to validate the readiness of the Electricity Sub-sector to
respond to a cyber incident, strengthen utilities' crisis response
functions, and provide input for internal security program
improvements. Seventy-five industry and government organizations from
the US and Canada participated in GridEx. BPS entities included
generation and transmission owners, reliability coordinators,
independent system operators, and balancing authorities. Key government
agencies, such as DHS, FBI, and DOE, were also heavily involved. GridEx
provided a realistic environment for organizations to assess their
cyber response capabilities. The biennial exercise was viewed across
industry and government as a training success in preparing the BPS for
a disruptive security event. NERC issued a final report in March 2012,
and is applying the GridEx recommendations to further strengthen the
bulk power system's preparedness and response mechanisms.
Given the heightened awareness of security in the Electricity Sub-
sector, NERC hosts an annual Grid Security Conference (GridSecCon) to
discuss emerging threats, industry best practices, and provide cutting
edge training to the industry. NERC will again host this conference in
October 2012, and will bring together cyber and physical security
thought leaders from government and industry to discuss securing
industrial control systems, social engineering attacks, and security
event response management, among other topics.
conclusion
As outlined today, NERC has many tools available, including
critical infrastructure protection standards and processes and the ES-
ISAC, to address imminent and non-imminent threats and vulnerabilities.
We work with multiple government, industry, and consumer partners to
support a coordinated comprehensive effort to address cybersecurity.
We appreciate this opportunity to discuss NERC's activities on
cybersecurity with the committee related to cybersecurity protection of
the grid.
The Chairman. Thank you very much.
Mr. Snitchler, go right ahead.
STATEMENT OF TODD A. SNITCHLER, CHAIRMAN, PUBLIC UTILITIES
COMMISSION OF OHIO
Mr. Snitchler. Good morning. Chairman Bingaman, Ranking
Member Murkowski, and members of the committee, I want to thank
you for the opportunity to appear before you today as we
examine the status of actions taken to ensure that the electric
grid is protected from cyber attacks. My name is Todd
Snitchler, and I am the Chairman of the Public Utilities
Commission of Ohio.
Our State agency is responsible for assuring residential
and business customers access to adequate, safe, and reliable
utility service at fair prices, ensuring the financial
integrity and service reliability of the Ohio utility industry
and, among other things, promoting utility infrastructure
investments, including investments in IT infrastructure. I am
pleased to have the opportunity to discuss cybersecurity issues
for the electric grid; because, often times, we take that grid
for granted.
Should Congress decide to pass legislation on
cybersecurity, however, it is my view that we must distinguish
between imminent threats, which require immediate action, and
vulnerabilities, which can be addressed and resolved more
deliberately. Particularly, regarding the electricity grid,
one-size solutions for cybersecurity may not be the most
effective means to mitigate and reduce known vulnerabilities.
Additionally, the desired outcome from such legislation
should be the establishment of a foundation that contemplates 4
basic considerations. First, we need to protect diamonds like
diamonds and apples like apples. That is, we must prioritize
accordingly to ensure that the appropriate level of security is
provided to all areas that require protection.
Second, States and the owners of critical infrastructure
that we regulate cannot protect the infrastructure to the
maximum extent possible, unless the relevant Federal agencies
provide the actionable information necessary to identify and
address the threat or vulnerability. In other words, true
information sharing between those who have the information and
those who need the information to protect their systems.
Third, our utilities can provide a gold-plated, or even a
platinum-plated, system which is ultra-cyber secure. However,
this raises the question of just how much do we want a kilowatt
hour of electricity to cost.
Fourth, preparedness should not focus solely on response
capabilities, but should also ensure that resilience is built
into the infrastructure. Our Nation's utilities--municipal-,
cooperative-, and investor-owned--have done this country proud
in responding to the greatest calamities and catastrophes,
quickly, and capably restoring power after significant storms,
earthquakes, wildfires, or even acts of terrorism.
As a State regulator, my fellow commissioners and I, as
well as our staff, have many responsibilities. Some items of
significance today are resolved and become less significant
down the road, and other items that are less significant today
may become a issue of paramount importance in the near future,
with a major change, for instance, in weather or technology.
This is true for many things, including the provision of
electricity in a safe, reliable, and economic fashion.
Just as utilities cannot protect against all threats,
neither can they eradicate all susceptibilities. We must
recognize there are different parts of these systems that
require different levels of protection. This is why we must
ensure there is adequate protection of the grid, especially its
most valuable parts, while we must not expend undue levels of
resources protecting other less important parts of the system.
Another point of consideration that must be recognized is
that State agencies, like the PUCO, along with owners of that
critical infrastructure, are unable to provide the full measure
of protection necessary to help secure the critical
infrastructure if the relevant agencies are not providing that
actionable information to address imminent threats.
State regulators take the reliability and security of the
bulk power system very seriously. Through strong, Federal,
State, public, and private partnerships, we have consistently
maintained and improved reliability and security of the grid.
Cybersecurity is an emerging area of risk for our utilities
and for State commissions as well. Although, it is unique in
some respects, this is not the first time that our State
utility systems have faced reliability threats. Through a
strong, public-private partnership, we have overcome past
risks. It is my belief that this emerging of information
systems into the electric and other utility sectors will
improve the resilience, reliability, and efficiency.
Cooperation and acceptance of responsibility is a must.
With modern threats becoming apparent to us in the last several
years, we understand that our traditional responsibility to
ensure reliable service must include the need to ensure
security, both physical and cyber.
Over the past several years, State commissions have begun
to probe the cyber preparedness of our utility companies in the
realm of the smart grid. In concept, the smart grid has the
potential to provide many improvements in situational
awareness, prevention, management, and restoration. In spite of
introducing new weaknesses, smart grid fundamentally makes the
electric system more secure.
In each of the areas that I have identified in my
testimony, steps are being taken to manage the risk. The issue
is how much money should be put into this effort when it is
virtually impossible to stop all attacks, but vitally important
to stop some.
Smart grid poses an additional and particularly thorny
policy issue, as well. Through NARUC's collaborative with FERC
on smart grid and other activities, State commissions have
begun to identify key areas to assure the smart grid
investments boast the highest, most sophisticated levels of
security. Commissions, therefore, have had to become more
expert in our understanding of the prudent smart grid and
cybersecurity investments.
In Ohio, for instance, an extensive audit was recently
performed on one of our utilities that complied with the NISTIR
7628, and industry best practices that were to identify
potential areas of improvement were set forth. This effort was
massive and will become a best practices model for other
commissions and utilities in their cybersecurity analyses and
efforts.
My testimony also lists a significant number of activities
that have been undertaken by the Ohio Commission, in our effort
to become more advanced in our understanding of cybersecurity
issues. I also identify several other States, including,
Pennsylvania, Texas, Missouri, and New York, who are also
making active steps to try and increase their understanding, as
well.
A long-standing mission of every State public utility is to
ensure the physical viability of the utility plan under our
supervision. A less traditional responsibility, that of
cybersecurity and information systems standards and
development, is increasingly being thrust into the mix, and
this newer responsibility clearly envelops a broader range of
industries and specific expertise.
I see that I'm out of time, and the rest of my comments are
in our written testimony.
Thank you.
[The prepared statement of Mr. Snitchler follows:]
Prepared Statement of Todd A. Snitchler, Chairman, Public Utilities
Commission of Ohio
Chairman Bingaman, Ranking Member Murkowski, and Members of the
Committee, thank you for this opportunity to appear before you today as
you examine the status of action taken to ensure that the electric grid
is protected from cyber attacks. My name is Todd Snitchler, and I am
the Chairman of the Public Utilities Commission of Ohio (PUCO), the
State agency responsible for:
assuring residential and business consumers access to
adequate, safe, and reliable utility services at fair prices;
ensuring financial integrity and service reliability in the
Ohio utility industry;
promoting utility infrastructure investments (including
investments in IT infrastructure); and,
related items like fostering of competition, safety, and
even mediation responsibilities.
I am pleased to have been given this opportunity to discuss
cybersecurity issues for the electric grid. We take for granted the
reliability of our nation's grid and we are hyper-sensitive when we
lose power because we are not generally accustomed to it--nor should we
be.
Should Congress decide to pass legislation on cybersecurity,
however, it must distinguish between imminent threats, which require
immediate action, and vulnerabilities, which can be addressed and
resolved more deliberately. Particularly regarding the electric grid,
one-size solutions for cybersecurity may not be the most effective
means to mitigate and reduce known vulnerabilities. Additionally, the
desired outcome for such legislation should be the establishment of a
foundation that contemplates at least four basic considerations.
First, let us protect diamonds like diamonds and apples like
apples. That is, we must prioritize accordingly to ensure that the
appropriate level of security is provided to all areas that require
protection.
Second, States and the owners of the critical infrastructure we
regulate cannot protect the infrastructure to the maximum extent
possible unless relevant Federal agencies provide the actionable
information necessary to identify and address the threat and/or
vulnerabilities--in other words true information sharing between those
that have critical information (the Federal agencies) and those that
need such information to protect their systems.
Third, our utilities can provide a ``gold-plated'' or even a
``platinum-plated'' system which is ultra-cyber secure. However, this
raises the question of just how much more do we want a kilowatt hour of
electricity to cost? While we understand that if the lights are not on
it does not matter what the cost of the electricity is, do we really
want the critical infrastructure to be so expensive that due to cost
constraints it is no longer considered critical?
Fourth, preparedness should not focus solely on response
capabilities, but should also ensure that resilience is built into our
infrastructure--our nation's utilities (municipal, cooperative, and
investor-owned) have done this country proud in responding to the
greatest calamities and catastrophes, quickly and capably restoring
power after significant storms, hurricanes, earthquakes, wildfires, and
even acts of terrorism.
As a State regulator, my fellow Commissioners and I, as well as our
Staff, have many responsibilities. Some items of significance today are
resolved and become less significant down the road. Other items that
are less significant today may become of paramount importance in the
near future with a major change in one variable like weather, for
instance. This is true for many things, including the provision of
electricity in a safe, reliable and economic fashion. Focusing on
reliability, there are many factors that impact that aspect--physical
infrastructure in place and operational considerations, such as
generators, wires, substations, transformers, and meters. Also greatly
impacting reliability is equipment failure. Equipment may fail due to
its age, its overuse or underuse, physical vulnerabilities, and as we
are aware, perhaps due to cyber vulnerabilities. Many of these
vulnerabilities have existed and are known, while other weaknesses are
more recently being better understood. Just as the electric utilities
cannot protect against all threats, neither can they eradicate all
susceptibilities. But we must recognize there are different parts of
these systems that require different levels of protection. This is why
we must ensure that there is adequate protection for the electric grid,
especially the most valuable parts, while we must not expend undue
levels of resources in protecting other, less important parts of the
system.
Another important point of consideration that must be recognized is
that State agencies like the PUCO, along with the owners of our
critical infrastructure, are unable to provide the full measures of
protection necessary to help secure our nation's critical
infrastructure if the relevant Federal agencies do not provide
actionable information to address imminent threats. State regulators
take the reliability and security of the bulk-power system very
seriously. Through strong Federal, State, public, and private
partnerships, we have consistently maintained and improved reliability
and security of the grid. As times and technologies have changed, new
risks and vulnerabilities have emerged. The transition to a smarter,
more efficient grid--while full of promise--carries with it unforeseen
concerns and unintended consequences. As Congress considers legislation
in this area, it should build on existing Federal-State coordination
and result in a framework where vulnerabilities to the system are
identified, prioritized, and resolved in a timely fashion.
However, identification of vulnerabilities is only one part of the
main equation; equally, or even more importantly, is a need by the
States and especially by the asset owners to recognize the threats to
the nation's grid. We hear consistently from asset owners who provide
information about their systems to Federal agencies in the spirit of
cooperation, all the while seeking reciprocity, yet they never receive
truly meaningful, actionable, timely information in return. They cannot
protect all of their systems against everything; none of us can. They
have to target their defenses and we have to help them understand the
actionable threats so that they may bolster their defenses where
needed.
As with most sectors of the economy, information systems are
rapidly merging with utility systems, potentially heightening the risks
of service disruption. Cybersecurity is an emerging area of risk for
our utilities and for State Commissions as well; although it is unique
in some respects, this is not the first time our utility systems have
faced new reliability threats. Through a strong public-private
partnership, we have overcome past risks, and it is my belief that this
merging of information systems into the electric and other utility
sectors improves their resilience, reliability and efficiency.
National security roles and responsibilities have been subject to
the purview of Emergency Management Agencies, State Police, and
Departments of Homeland Security. However, the lines defining and
separating roles in critical infrastructure protection between the
Federal government, State agencies, and the private sector owners of
critical infrastructure are necessarily overlapping now. Cooperation
and acceptance of responsibility is a must. With modern threats
becoming apparent to us in the last several years, we understand that
our traditional responsibility to ensure reliable service must include
the need to ensure security--both physical and cyber. Breaches of
security, obviously, can have extremely serious reliability
consequences. From my vantage point, State commissions can identify
certain key areas of concern about cybersecurity. The first concern
focuses on business process systems--email, office computing,
databases, etc.--that are not unique to utilities. In fact, commissions
in recent years have improved their own security, along with everyone
else, as attacks on these systems become more sophisticated and we
become more dependent on them for our operations.
A second vulnerability is more specific to regulated utilities:
control systems. Supervisory Control and Data Acquisition (SCADA)
systems have been and remain an inextricable part of utility
operations, and have served to improve the efficiency and reliability
of our system operations in every system throughout the country. In
recent years, susceptibilities in these SCADA systems have been
repeatedly highlighted.
Over the past several years, State commissions have begun to probe
the cyber-preparedness of our utility companies in the realm of smart
grid. With tens of billions of dollars in investment on the line,
commissions want to know that the investments are not going to
introduce new and unmanageable risks. In concept, the smart grid has
the potential to provide many improvements in situational awareness,
prevention, management, and restoration. In spite of introducing new
weaknesses, smart grid fundamentally makes the electric system more
secure. Still, this technology brings with it new vulnerabilities and
points-of-access to create intentional disruption, which should be
taken extremely seriously. ``Guns-gates-and-guards'' analogs of
password protection and ``security through obscurity'' must be
augmented with a framework of maximum system resilience and next-
generation safeguards that allow the network to be impregnable, even if
devices connected to it are compromised.
In each of these areas, steps are being taken to manage the risk.
The regulated companies that we oversee, through the North American
Electric Reliability Corporation (NERC), are continuously in a process
of developing and updating standards for cybersecurity that we believe
are a good step in the right direction for SCADA and business process
systems. NERC, for example, has adopted a cyber-security standard for
the bulk electric system. NERC's cybersecurity (``CIP'') standards are
extensive and thorough. Over the past five years electric utilities
across the country have requested significant additional staffing and
dollars for CIP standard compliance activities in their transmission
rate case filings at FERC. The CIP standards already in place are
adequate for both physical security and cyber-security. However,
extending the applicability of those standards to lower voltage
facilities raises the question of how much more we are willing to pay
for a marginal increase in cybersecurity. The issue of how much more
money should be put into this effort when it is virtually impossible to
stop some cyber attacks (e.g., hackers getting into the Pentagon's
computer system) needs to be addressed.
Smart grid poses an additional, and particularly thorny, policy
issue as well. Through NARUC's collaborative with FERC on smart grid
and through other activities, State commissions have also begun to
identify key areas to assure that smart grid investments boast the
highest, most sophisticated levels of security. Recent Federal funding
support for smart-grid investments has incentivized the deployment of
hardware in advance of the development of standards for cybersecurity,
among other issues. Commissions may be confronted with expenditures on
cybersecurity for which no specific standard has yet been reached. This
draws commissions into specific areas of review in order to determine
the prudence of expenditures--a review that would be unnecessary if the
expenditure would be made in compliance with recognized standards.
Commissions, therefore, have had to become more expert in their
understanding of prudent smart grid and cybersecurity investments.
Because we are driven by our obligation to assure the reliability of
service for our ratepayers, we must better understand the prudence of
the costs in ensuring reliability (including expenditures for cyber-
security) that goes into their rates. As a result, our agency has
expended significant time and resources to become better educated
regarding cybersecurity. Over the past several years, as the electric
industry aptitude has grown regarding cybersecurity, so too has that
knowledge base grown across State commissions.
In Ohio, for instance, regarding the smart grid discussion above,
an extensive audit was conducted to assess the degree to which Duke
Energy Ohio's Smart Grid system complied with the NISTIR 7628 and
industry best practices and identify potential areas of improvement,
which was a precursor to the action items in the stipulation. An
internal audit was also provided during the audit and included
penetration testing on a number of Smart Grid assets. An extension
stipulation was reached regarding Duke's cybersecurity plan and the
implementation of that plan, including the role of the Commission. This
effort was massive and will become a best practices model for other
commissions and utilities in their cybersecurity analyses and efforts.
We have been very involved in the NIST's and now the Smart Grid
Interoperability Panel's (or SGIP's) Cyber Security Working Group. My
agency has been very active in pursuing cybersecurity training
opportunities with Idaho National Labs, NIST & NIST's ITL Computer
Security Division, the SGIP, EnerNex, NERC's Grid Security Conference,
and others, as well as participating in the development of the initial
NIST-IR 7628, the most recent version being a multi-volume compendium
of Smart Grid Cyber Security Strategy and Requirements. We have
actively participated in the National Association of Regulatory Utility
Commissioners (NARUC) Cybersecurity Boot Camps. Additionally, our Staff
participates in two different sets of regular, twice-monthly conference
calls with our colleagues from across the country. These calls address
critical infrastructure protection issues, cybersecurity issues for
utilities, as well as smart grid development and implementation issues.
Our Staff participates in monthly threat briefings for both the
electric sector as well as the oil and natural gas sector. Also, our
Staff regularly participates in weekly briefings with Ohio Homeland
Security. Through this partnership, our agency has a permanent seat at
the State of Ohio's Strategic Analysis and Information Center (or
SAIC), just as it does in our State of Ohio Emergency Operations
Center. Presently, the State of Ohio has developed a Statewide
Cybersecurity Strategy and our Staff has been actively engaged in both
the development as well as the on-going implementation of that
strategy. Over a year ago, my agency conducted a cybersecurity workshop
for our utilities as well as for our State and Federal partners.
Leading part of that workshop was a representative from the U.S.
Department of Energy's Cybersecurity for Energy Delivery Systems
program. Also participating was Ohio's Homeland Security Advisor, as
well as representatives from the cyber squads from both of the FBI
divisions in Ohio. In addition, the two U.S. Department of Homeland
Security (DHS) Protective Security Advisors stationed in and serving
Ohio addressed not only their physical protective security program, but
also DHS's cybersecurity advisor program and the related cyber
resources and tools available from DHS for asset owners. Our efforts in
strengthening the cybersecurity posture of Ohio's utilities continue.
Ohio also has one of the premier military bases in the country--
Wright-Patterson Air Force Base. Located in the south-western portion
of the state, this base employs a significant number of personnel and
performs mission-critical work for the Department of Defense. My agency
has worked with this base in the past, and will do so in the future, to
ensure that it has what it needs to accomplish its objectives.
While I am not an expert on what other States are doing with regard
to cybersecurity, I am aware of a few examples of activity that State
commissions have engaged in, to ensure that companies are focused on
this issue. In most instances these activities are coordinated with
other State agencies that also have a jurisdictional responsibility for
safety and/or security.
Since 2005, the Pennsylvania Public Utility Commission has required
all jurisdictional utilities to have a written cyber security plan to
complement their emergency response, business continuity and physical
security protocols, each of which are tested on an ongoing basis. The
Pennsylvania PUC has issued orders on cybersecurity in reaction to
media reports of grid infiltration by international hackers.
Pennsylvania also issued a secretarial letter to its utilities
encouraging them to be active in the NIST Standards development process
by reviewing and commenting on the NIST Framework and the Cyber
Security Coordination Task Group documents and to participate in
various related working groups. Pennsylvania has also incorporated
cyber-security review in its management audits process. Pennsylvania
performs management and efficiency audits at least once every five
years on all electric, gas, and water utilities with over $10 million
of plant in service.
Another State taking action is Missouri. Missouri requires all of
its utilities to have in place reliability plans and has queried its
utilities about steps taken or planned regarding cybersecurity as it
relates to company operations. The Missouri Commission required the
utilities to furnish Staff with a verified statement affirming whether
the company is in compliance with NERC Order No. 706 or what remedial
actions are to be taken and how long it will take the company to become
compliant. The Commission also asked what other organizations, groups,
industry groups or other organizations these companies participate
with, such as local FBI or State agencies, regarding security issues.
In New York, they are sharing the responsibility for critical
infrastructure protection at the Department of Public Service. Since
2003, when it was created, the New York State Public Service Commission
Office of Utility Security has carried out a regular program of
oversight of both physical security and cybersecurity practices and
procedures at the regulated utility companies in the energy,
telecommunications and water sectors. Staff of this office is devoted
full time to this security audit responsibility. Generally, that office
utilizes the existing NERC CIP standards as benchmarks to form its own
judgments about the quality of cybersecurity measures in place at New
York's regulated utilities. Its Staff adheres to a schedule that calls
for visiting each regulated electric utility company four times a year
to audit compliance with some portion of the CIP standards, with the
goal of measuring compliance with all of the standards at each company
over the course of a year.
The Public Utility Commission of Texas has established a
stakeholder working group (comprised of utilities and ERCOT Staff)
designed to work on issues specific to cybersecurity. This effort is
lead by Texas Commission Staff. The group meets regularly to discuss
the cybersecurity assessments performed on Smart Meter Texas, which is
the common portal that provides end-user access to energy usage data
sourced from the AMI that was deployed by the respective utilities.
Each utility is responsible for securing its own AMI and cybersecurity
assessments are required of the utilities by rulemaking once deployment
of AMI and other smart grid technology is approved. Regulations include
requirements for end-to-end assessments, performed independently and
annually of the utility system. These results are kept confidential but
shared with the Staff.
In addition commission staff participates in the discussions at the
ERCOT ISO Critical Infrastructure Protection Working Group (CIPWG), in
which NERC CIP issues are discussed. While this concerns the bulk
electric system, other topics related to cybersecurity that are
broached include: newly discovered vulnerabilities; emerging threats to
critical infrastructure; cybersecurity standards development from
outside NERC; mission assurance for the military; and any cybersecurity
training opportunities, conferences, workshops, or exercises.
A long-standing mission of State public utility commissions is to
ensure the physical viability of the utility plant under their
supervision. A less traditional responsibility, that of cybersecurity
and information systems standards and development, is increasingly
thrust into the mix, yet this newer responsibility clearly envelops a
broader range of industries and specific expertise. Utility regulators
recognize the dependence of sound cybersecurity practices and cyber
reporting on sound construction practices and utility-outage reporting,
and vice versa.
A concern that I wish to leave with you for consideration is that
protocols intended to distinguish between disruptions to critical
infrastructure related to cyber events and those related to physical
events, for example, a distributed-denial-of-service (DDOS) attack as
opposed to a fiber-optic cable failure, have not kept up with the fast-
emerging nature of cyber threats. Such protocols are easier to craft
than to implement. The first evidence of disruption is the disruption
itself, and such events do not often present themselves with the root
cause clearly visible.
In the critical ``golden hours'' after a possible new developing
threat is detected, or immediately following an event, it may not
always be clear what is actually happening or why. For this reason,
close coordination between the utility sector and the cyber sector is
essential to the response. As the State public utility commissions have
traditionally served as the gateway to the utility sector and have
their own independent core of expertise and relationships key to
understanding, in real-time, events affecting that plant, close
coordination among the operators of our cyber networks, the Federal
government, and State homeland security partners, including State
utility commissions, is essential. Resolving cybersecurity issues will
require significant efforts on the parts of all of us, not just one or
two of us. We all are part of the solution. Working with the asset
owners and with our Federal partners, the States have been successful
in the past in enhancing the overall reliability of our nation's
electric grid. Our Federal government possesses significant assets that
can provide States and the critical asset owners with timely and
actionable threat information necessary to better secure these assets.
We are partners in this struggle to maintain and enhance the
reliability of our electric grid and to increase its resiliency, and we
must all work together to achieve our collective goal.
Mr. Chairman and members of the Committee, this concludes my
testimony. We at the Public Utilities Commission of Ohio take the
issues of cybersecurity and reliability very seriously. As such, we
believe a Federal-State, public-private partnership is essential to
meeting these challenges over the long term.
Thank you again for the opportunity to provide testimony here today
and I would be happy to answer any questions that you or members of the
Committee may have.
The Chairman. Thank you. Thank you, all, very much for your
testimony. I will start with a few questions.
Mr. Cauley, let me ask you first, Could you describe what
happens when a vulnerability is discovered, vulnerability to a
cyber attack, for example. If you issue an alert to utilities
about that vulnerability, is there any requirement that they
follow your advice on that alert?
Mr. Cauley. Thank you. We produce the report with
intelligence information from the Government, with cleared
experts. We create a document that we can then issue to
industry, which is unclassified. We have 3 levels that we can
issue. One is an informational heads-up. One is a
recommendation, which we can track the results and performance
of the recommendations. The third is an essential action, if we
feel that it is imperative that the industry implement that.
Then, our board can approve it, and it is a required action,
and the industry is required to report back the results of that
performance.
The one area I pointed out last year in testimony was the--
even though the industry is required to report back and they
are required to implement the action, there is not an
enforcement mechanism for that. I appreciate that in the
discussion of that legislation, there was an inclusion to deal
with that gap.
The Chairman. So, at the current time, if you issue an
alert and you say, ``Take the following action,'' and the
utility does not do so, you have no ability to enforce that?
Mr. Cauley. The industry is required to respond by our
rules and by rules that FERC has approved, so the--we are
limited at this point to a civil action, but not within our
current rules and our current framework.
The Chairman. So, you can take them to court?
Mr. Cauley. We could.
The Chairman. But there is no immediate penalty or
immediate remedy available to you.
Aurora, I guess, is the most famous cyber vulnerability
that has sort of gotten a lot of publicity. It was on CNN for
several days back in 2007. You issued an advisory for that
vulnerability, I believe; is that correct?
Mr. Cauley. That is correct.
The Chairman. Are you able to track how many utilities
still have not complied with the recommendations in that
advisory?
Mr. Cauley. We were able to--one of the first things I
came--did when I came back to NARC as CEO in the beginning of
2010, as I recognized that the information that the industry
had from 2007 was insufficient, unclear, and, essentially, not
actionable--so, we worked to issue another alert in 2010,
which, I think, points out the importance of information
sharing and access to information. So, we were able to put out
a meaningful alert in 2010. We are tracking on a twice-yearly
basis. We are tracking on the completion of mitigation. We have
that information, and we file it with the Commission. It is
sensitive information because of the nature of the
vulnerability, but we do track that and file that with the
Commission.
The Chairman. It seems to me--and you can just respond and
tell me if I am misstating the situation. But it seems to me
that the way the standard-setting process works, standards
should be developed as a general framework for exercising
authority to require mandatory actions in the case of a
vulnerability being discovered. In fact, the way the system is
working is that you are required to issue a new standard, with
all of the accompanying delay, for any new threat that comes
along, or if you don't do that, then you are left only with the
ability to make non-binding recommendations. Now, is that a
fair statement of where things stand?
Mr. Cauley. I think, Mr. Chairman, not every risk or
challenge or vulnerability requires a standard. We get a lot of
things corrected with information and just explaining to the
industry what the issues are. There is a lot of problem-solving
going on every day.
Alerts give us an opportunity to deal with emerging issues
or issues that need a timely response. Whether or not we could
develop--we could develop a standard on Aurora. The difficulty
with that is, it is more of an equipment manufacturing-type
standard, which is more applicable to an IEEE, the Institute of
Electronic and Electrical Engineers, and I understand that they
are committed to looking at that issue as a technical standard
on equipment.
If the Commission felt that there was a vulnerability that
had been out there and had been out there too long, my belief
is that, within the current section 215, the Commission could
issue an order to the ERO to produce that standard, if it was a
priority over other risks that we are dealing with.
The Chairman. Senator Murkowski.
Senator Murkowski. Thank you, Mr. Chairman.
I am going to ask a little bit more about information
sharing. It is something that each of you has addressed.
Clearly, the NERC plays a role here with the Electricity Sector
Information Sharing and Analysis Center, where you share and
analyze the information. You have mentioned some of that. But
it sounds like even from NERC's point of view, you would urge
Congress to do what it can to facilitate further information
sharing.
Mr. Snitchler, you have indicated how important it is that
the Federal agencies provide the actionable information, too,
to help address or identify threats or vulnerabilities. GAO has
also mentioned that.
So, let me start with you, Mr. McClelland. Does the FERC
think that the private sector has the information that it needs
today to take action to address the cybersecurity threats and
vulnerabilities from the information sharing perspective; do
you have in place what you need?
Then, if I could ask each of you to just further address
this, because I think this really goes to the heart of what we
are talking about here today.
Mr. McClelland. Thank you, Senator.
I think, in general, the security practices are well-
documented. I think there are protocols to standards. There are
alerts and advisories that detail specific security protocols
to improve the security posture of the utilities.
But, specifically, no, there are circumstances where there
may be a specific actor that has targeted a particular piece of
equipment or an operating practice. In those cases, it is
important that those individual entities, and the industry at
large, perhaps to a lesser degree if they don't have that
specific equipment, is brought in, counseled, shown the threat,
and then, any particular mitigations that could be applied are
explained to that entity.
Senator Murkowski. So, then, to the rest of you. How do we
do a better job of the information sharing?
Mr. Wilshusen.
Mr. Wilshusen. One is to make sure that there is an
appropriate mechanism in which--in place to actually share
information on a timely, actionable basis.
We did a review a couple of years ago at the Department of
Homeland Security, of its lead role promoting the private-
public partnership in securing our critical infrastructures,
which include the electricity grid. We found that, to a large
extent, the information that DHS provided through its alerts
and threat information was not meeting the expectations of its
private sector partners.
In many cases, the information was not actionable, not
timely. So, one of the means that would have to take place is
to ensure that the information that is being provided is
current, timely, and also anonymized. That has been one of the
problems, is making sure that the information is sufficiently
anonymous, so as not to identify any particular company or
organization, but gets the information out to the individuals
who actually put fingers on keyboards and secure the systems.
Senator Murkowski. Mr. Cauley.
Mr. Cauley. Senator Murkowski, I fully agree with the
suggestion that the most important thing that legislation could
do would be to foster a robust information sharing between
Government and industry.
Today, it is happening, but it is sort of like sipping from
a lawn hose. We just need more. Also, the information sources
are ad hoc across agencies, so we work out individual
relationships with agencies to get information. We have a very
limited access to clearances within the industry, particularly
on the top secret side. The value of that is, only industry
experts can really, fully understand the impacts. Often, our
limited folks that we have that do have clearances are
explaining back to the intelligence folks what might be the
impacts for a particular threat. So, I think getting more
clearances, having a more unified system for sharing of
information would be very beneficial.
Senator Murkowski. Mr. Snitchler.
Mr. Snitchler. Senator, what we hear from the utilities
that we regulate is, often, that there is--they perceive a one-
way information street, and they provide information and don't
feel that they are getting a reasonable amount of information
in return. By that, as already mentioned by other panelists,
some of the specific data that could be helpful to them.
There is also, I think, often times, the fear of disclosure
will result in practices that maybe impact one utility, as
opposed to all of them equally. So, there is a reluctance,
perhaps, to share granular detail that might be helpful.
Again, the anonymized information that was previously
referenced, I think, would be helpful for that, because then it
would ensure that we could have better disclosure of
information in both directions.
The critical component that we hear from utilities, without
exception, is the need for security and that information not to
find its way out into the public realm because of the potential
implications, both to them and to the utility system.
Senator Murkowski. Thank you. Thank you, Mr. Chairman.
The Chairman. Senator Wyden.
Senator Wyden. Thank you, Mr. Chairman. Mr. Chairman, thank
you for holding this hearing. I think it is extremely timely,
in light of the leader's desire to bring cyber legislation to
the floor. I want to review with the 4 of you, essentially,
where things are, on a couple of key questions.
Now, as Chairman Bingaman noted, there are already rules in
place that include cyber threats to the electric grid, and
that, of course, was launched years ago. Now, this exercise
seems to have produced another division in what I call the
``growing cyber industrial complex.'' For years now, the
Federal Energy Regulatory Commission and the North American
Electric Reliability Corporation, private companies, and lots
of lawyers have shuffled paper back and forth, grants have been
dispensed by the Department of Energy, and this has produced a
product that has left few satisfied.
So, let me start with you, Mr. McClelland, in terms of some
of the concerns that would be helpful to have addressed this
morning. Do you believe that because the standards don't
require a physical separation, between the energy company
networks that run the business operations and the critical
infrastructure--the substations and the transmission--that
despite all of this paper shuffling, this shortcoming is still
a significant factor in making the electric grid vulnerable to
attack?
Mr. McClelland. I will answer that and then maybe add a
little to it, is that one of the CIP standards, CIP 5, requires
an Electronic Security Perimeter around a critical cyber asset.
Only critical cyber assets, which are self-designated by the
entity that is captured by the standard, are covered by the
standards themselves. So, if an entity decides it has critical
cyber assets, then it designates an Electronic Security
Perimeter around those assets. If the business systems are
connected to the critical cyber asset, via the SCADA systems,
or whatever the control systems are, then those business
systems, theoretically, fall within that Electronic Security
Perimeter.
So, if they are interconnected, if they work together, if
they can't be separated, the assumption I would have is that
they would be within--they would both be included within that
ESP and physically protected.
Senator Wyden. But the bottom line is, the networks don't
have to be separate, is that correct?
Mr. McClelland. That is correct.
Senator Wyden. OK. The second question I would like to ask
of you is, that, for purposes of the legislation that is being
considered for the floor of the Senate here before August, some
companies are asking, that for purposes of this bill, they
should be legally protected--legally protected through
indemnification provisions when they report vulnerabilities in
any cyber network.
Now, it is my understanding that, with respect to the 2005
law, there is no such legal protection; is that correct? If so,
is the absence of that kind of legal protection or
indemnification processes--has that caused any problem in your
view?
Mr. McClelland. Under the cyber standards or any of the
reliability standards, one of the considerations under the
violation severity level is whether or not an entity self-
reports its problem. That is taking into consideration, as far
as the enforcement provision, the penalties, how willing they
are to admit that they have a problem, what the mitigation plan
looks like, how timely they could be. So, self-reporting is an
important aspect, as far as mitigation of the enforcement
aspects, even under the existing network or the framework.
Senator Wyden. But the question is, Are there
indemnification procedures now? My understanding is there are
not.
Mr. McClelland. Right.
Senator Wyden. Is the absence of these provisions causing
any problem? The reason I am asking is because this is going to
be a big issue in the discussion, is whether or not there ought
to be these indemnification processes when companies come
forward and report problems. What I would like to know is, if
there are any problems today, as a result of the lack of
reporting requirements. Could you answer that?
Mr. McClelland. I guess I would answer it by saying that,
the self-reporting requirements--you know, the enforcement
provisions under the existing standards are important, and if
it is not a standard that compels action, then it is not
something that you can assure happens.
You know, information exchange, alerts, advisories,
essential actions can be helpful. But, at the end of the day,
if there is no enforcement provision, it--there is no teeth
behind these issues.
Senator Wyden. I will try one more time. Do you think----
[Laughter.]
Senator Wyden. Do you think indemnification procedures are
needed for purposes of this bill that is going to be considered
for the floor before August, yes or no?
Mr. McClelland. I am just not prepared to comment on that.
I'm sorry.
Senator Wyden. OK. Thank you, Mr. Chairman.
The Chairman. Senator Franken.
Senator Franken. Yes, Mr. McClelland, do you think--no, I'm
not good at that----
[Laughter.]
Senator Franken. But this question is for you, and for
anyone who wants to pick up on it. Deploying a smart grid is
crucial for integrating distributed and renewable energy
resources, but a 2011 GAO report noted that, while FERC has
authority to adopt smart grid standards, it does not have any
specific enforcement authority to implement these.
What are your recommendations for ensuring that standards
are properly developed and enforced? Is this issue adequately
addressed in any of the cyber security bills before the Senate?
Mr. McClelland. The GAO did find--they did echo FERC's
finding from its policy statement on smart grid, that it lacked
enforcement authority under the EISA that was passed by
Congress. So, we do not have enforcement authority, even if we
find that cybersecurity standards, as recommended by NIST,
achieve sufficient consensus.
The Commission's authority, however, does lie under 215.
So, pursuant to that authority, the Commission has been an
active participant in NIST's SGIP and Cybersecurity Working
Group. Our staff attends those meetings. They are regular
participants. They bring that information then back to the NERC
215 process when they actively engage in the standards
development teams under the cybsersecurity standards. In fact,
the Commission most recently, in approving version 4, even
reminded NERC that it needs to consider those NIST provisions
and incorporate those NIST provisions, as appropriate, in
version 5 of the standards.
So, I can't speak to the pending legislation. I'm sorry,
Senator. I'm just not current with it. But I can say that the
Commission is actively engaged in the NIST process, is actively
working to incorporate the relevant aspects of that NIST
process into the NERC standards.
Senator Wyden. Mr. Wilshusen----
Mr. Wilshusen. Yes----
Senator Wyden. You helped prepare this report, so do you
have any comment?
Mr. Wilshusen. Right. I would just add that what Mr.
McClelland is referring to with section 215 is their ability to
enforce mandatory standards established by NERC over the bulk
power system. But under the Energy Independence and Security
Act, which deals primarily with the implementation of smart
grid technologies, much of those technologies are implemented
and deployed at the distribution level, which is more under the
purview of the State regulatory commissions and others.
I believe FERC does not have the enforcement capability at
that level, under EISA or----
Senator Wyden. Mr. Snitchler, that is fine with you?
Mr. Snitchler. Senator, we----
Senator Wyden. From what I am hearing?
Mr. Snitchler. Correct. We think we have got an adequate
handle. Ohio has approached the smart grid deployment than
other States--each of us has approached it in a different
fashion--where we have rolled it out in a series of pilot
projects with one utility that is now moving toward full
deployment, others who are further behind the curve, but are
moving forward. We have been able to work closely with those
utilities to make sure that they are operating in a way that
gives us a level of comfort, that they have a sufficient amount
of security going forward.
We actually have had a couple of open dockets at the
Commission, in an effort to determine where companies are at,
what steps are being taken. But, like other State commissions,
it is sometimes a challenge to have our utilities come in and
disclose the weaknesses in their system. So, the issue of
confidentiality, again, rears its head, even at the State
level, as we try to protect that information and prevent it
from becoming part of the public domain.
Senator Wyden. Taiwan, Singapore, China, South Korea are
among the largest manufacturers of semi-conductors and
microprocessors for these smart devices.
There are concerns that if a cyber criminal gained access
to such devices, especially during a manufacturing process,
they could covertly insert code in the devices to impair its
function.
For any of you, are we testing these purchased devices to
mitigate potential vulnerabilities?
Mr. Wilshusen. I guess I will take that question first. IT
supply chain has been a key vulnerability into systems and the
critical infrastructures of this Nation. We issued a report
earlier this year that dealt with IT supply chain and dealt
specifically with some of the microprocessing chips.
We looked at several agencies, including DHS, Energy,
Department of Defense. To a large extent, we found that the
procedures for reviewing the vulnerabilities on IT supply
chains and the types of equipment that are being acquired,
agencies really have not established effective mechanisms to
adequately address that vulnerability.
To some extent, it needs to be done at the national level,
because the risks are more national in scope. The
administration has recently developed an IT supply chain
strategy. We are in the process of looking at that strategy as
part of our ongoing work.
Senator Wyden. My time is up. Does anyone have another
comment? I saw Mr. McClelland be nodding.
Mr. McClelland. I would only add that, you know, hardware
is one component. Any time there is two-way electronic
communication, there is a chance for compromise, and there are
some very sophisticated entities out there that employ various
mechanisms, including hardware compromise, to accomplish that
task. So, it is a critical aspect of network security.
Senator Wyden. OK. Thank you, gentlemen.
Mr. Chairman, thank you.
The Chairman. Mr. McClelland, you mentioned this problem of
electromagnetic pulse events. I gather our former Congressman
and Speaker, Newt Gingrich, had a op-ed in the ``Washington
Post'' this last week, where he argued that we need to pass
legislation to protect against electromagnetic pulse events,
and you seem to say the same thing in your testimony as I read
it.
Is there anything being done, just at the current time, to
deal with this problem?
Mr. McClelland. The Commission recently held a technical
conference on this very subject. It invited NERC and industry
experts, and it compared the Commission's report through the
Oak Ridge National Laboratory, to the NERC report. It asked for
comments and sought consensus.
So, the Commission does have the industry's comments. We
are reviewing what can be done, where there is areas of
agreement and disagreement. But one thing that was encouraging
from the conference is that we thought we heard, regardless of
the scale of destruction or damage to the equipment itself,
there would be a widespread grid collapse, and everyone agrees
that that must be prevented.
So, coordinated studies need to be done among the entities.
There are, likely, standards that need to be passed, not
necessarily NERC standards, but industry standards, to prevent,
you know, damage to vulnerable equipment. There is a subset of
critical and vulnerable equipment that should be protected--no
regrets actions that should be pursued to protect the public
against this issue.
The Chairman. I guess one obvious question is, What kind of
timeframe are we talking about here? I have the distinct
impression we may be studying this issue while the electric
grid collapses. What is your understanding of the timeframe to
get something done?
Mr. McClelland. The Commission is moving through completion
of reviewing those comments, and under existing authority, it
can address the geomagnetic disturbance issue through
reliability standards. So, the Commission is now informing
itself from the NERC study, from the Oak Ridge study, and from
the public comments, and it is moving to review its options
under its existing authority to address the issue.
The Chairman. So, does that mean this year something is
going to be done?
Mr. McClelland. I'm sorry, I just can't speak to the timing
of Commission action.
The Chairman. Whenever people talk about, ``We're moving to
review our options,'' that doesn't sound like anything imminent
to me.
Mr. Cauley, did you have a point of view on this issue?
What is NERC doing to solve this problem of the threat from
electromagnetic pulse attacks?
Mr. Cauley. Thank you, Mr. Chairman.
We issued a report in February, which put the engineering
and science behind the characteristics of what kind of failures
and things we might see, and we have initiated a number of
actions. We issued an alert to industry. We have been working
with NASA and NOAA in terms of enhancing the alert system, so
we can let industry know if there is an issue impact coming,
and that we can put the system in a more conservative position
to withstand an event.
We are also working with EPRI, Electric Power Research
Institute, in terms of locating monitors on--Earth current
monitors, as well as equipment monitors, so we can understand
and see the behavior of the impacts and know what we need to do
to address that.
This is a long-term effort. I realize that we could have
impacts near-term, but really there is a lot to learn and
develop. We are also looking at doing testing on transformers,
in terms of inducing Earth-type simulated currents in them and
seeing how they behave and how they react.
So, there is a lot of working on them on multiple fronts.
We are not waiting for standards. We are actually moving on the
engineering and the modeling and the operational----
The Chairman. When you say you issued an advisory--or an
alert, I guess--what did you refer to it as, an advisory or an
alert?
Mr. Cauley. It was a NERC alert, yes.
The Chairman. An alert. Was that a set of directions to
utilities to take particular action, or was this just basically
saying, ``Here's a problem''?
Mr. Cauley. This one was informative, sir, so it gave
actions that could be taken if there was a impact full storm
that was going to come toward the Earth, actions that would be
recommended to be taken. But it was not issued as a required
set of actions.
The Chairman. So, no required actions have been----
Mr. Cauley. Not in this particular----
The Chairman. Recommended----
Mr. Cauley. That is correct.
The Chairman. At this or put forward?
Senator Murkowski, did you have other questions?
Senator Murkowski. This is more of a general question to
all of you. I think Mr. Wilshusen, you mentioned that, perhaps,
standards should not be spelled out too specifically or
utilities kind of get in this compliance mode of trying to meet
the standards, instead of safeguarding the systems.
We want to push everybody to be one step ahead of the guys
that are trying to disassemble things, and so, we don't want to
get them focused on just checking the boxes off; we need them
to be thinking ahead every single day. This whole issue of
flexibility within a system, as opposed to a prescriptive set
of standards concerns me. My concern is that the legislation
that is being considered right now, not the secure IT, but what
is coming out of Homeland, is a more prescriptive approach.
Can I ask each of you to speak just to that issue, as to
the need for flexibility in this area that allows us to be a
little more nimble, rather than just complying with a set of
standards?
We'll just go from you, Mr. McClelland, on down.
Mr. McClelland. Thank you, Senator.
I agree. I think all of the panelists would, too, that the
individual entities have to have the latitude to have the
directive, but not be so prescriptive as to tie them into any
singular response.
On the other hand, though, someone needs to make certain
that the Mitigation Act is effective. Back to that question
about Aurora, you know, it's not enough just to collect survey
data; it is important to verify the mitigation. So, I agree; I
think the standard needs to compel action, but provide the
latitude that the individual entities might need to address the
issue on their systems.
Mr. Wilshusen. Yes, definitely, I think standards need to
be flexible. They should not be overly prescriptive, because
you want them to stand the test of time. You don't want to
necessarily change your standard every time there is a new
threat or a new technology that emerges that presents
additional vulnerabilities.
As a parallel, in the Federal Government, NIST issues
Federal information processing standards, which are mandatory
requirements. In addition, though, it has issued lower levels
of guidance, usually through special publications and
guidelines that provide increasingly more detailed actions that
can be taken to secure systems in cybersecurity. But they are
more prescriptive, and they are at a greater level of detail
than the actual Government-wide standards. This greater level
of detail is needed to effectively secure systems.
So, it is good NIST had that flexibility and multiple
layers of guidance--standards, guidelines, and instructions, if
you will, to provide to organizations to secure their systems.
Senator Murkowski. Mr. Cauley.
Mr. Cauley. Senator Murkowski, I agree, as well. The most
effective standards will be based on risk controls, setting up
systems to catch issues that need to be identified, not on a
prescriptive, line-by-line, rule-based-type standards. We are
adopting those risk controls in the version 5 standards. We are
looking at the NIST model. We have extracted from their set of
standards, the ones that we think would work in the power
system, and we are flushing those out within those standards.
There is an added factor within--in the security arena, is
that you really want to incent people to report issues. Because
part of the intelligence is finding out what are the bad guys
doing and what information are we finding, and lots of little
pieces mean something when you roll it all up together.
So, if we are going in with a checklist style of
compliance, it is not going to be helpful that. We want people
reporting information, actively. I think we are on the right
track for that.
Senator Murkowski. Mr. Snitchler.
Mr. Snitchler. Senator, at the risk of saying, me, too, I
would agree with the comments made by the prior panelists. I
think the flexibility that you have suggested, necessarily,
moves into that resiliency that can be developed by the
multiple utilities that we regulate, taking a different
approach to achieve to same objective. That diversity of
approach to solving a problem also potentially has the ability
to keep an entire system from being knocked down, because,
instead of targeting one set of security concerns, you are
looking at more than one set and ways that that problem may
have been solved, and has the ability to require far more
effort on the part of those that will do ill-will to the
electric grid or to those who may be seeking to try and damage
the country.
I think, also, by moving away from a prescriptive, check-
the-box, as you describe it, list is helpful, and that we are
then charging the utilities that we regulate with being as far
as they can, one step ahead of, in evaluating all the threats,
whatever they may be.
I know that I have been to at least one utility in Ohio's
command center where they are doing just that and have retained
security folks to deal with those issues, in an effort to
ensure that they are viewing all the potential sources of entry
and all the potential manners in which they can respond and
block those out, at various levels within their system.
Senator Murkowski. Thank you, Mr. Chairman.
The Chairman. Senator Udall.
Senator Udall. Thank you, Mr. Chairman.
Good morning to all of you. Thanks for joining us on this
important topic.
Mr. McClelland, if I could, I will start with you. This may
be a tangent--a slight tangent, more accurately. I don't know
if any of the witnesses have addressed work force issues in
their written testimonies, but I realize one of NERC's
standards refers to personnel training requirements.
I am curious whether you believe we have the right people
with the right training in place at FERC, at NERC, at the
utilities, or elsewhere, to develop and implement the standards
to keep the grid secure and respond to threats and
vulnerabilities.
Do you think we would be more secure with additional and
better training to cyber warriors?
Mr. McClelland. I would say, yes. We do have--the
Commission is fortunate to have--it is a small staff, but it is
a very talented staff that we have mostly drawn from other
agencies, and they have spent their entire careers in
cybsersecurity. I think NERC is also gifted with some of the
employees that they have in place. But these folks are as
scarce as hen's teeth, and it is difficult to find them. In
many cases, we steal them from each other.
That said, we have been able to--and I know NERC has also
taken advantage of this. We have leveraged the intel agencies
with some of the best, probably--well, undoubtedly, the best
skill sets in the world. So, we leverage those intel agencies
to help us understand what the issues are and to address the
threats. But, certainly, more and well-trained cybersecurity
people are something that we all need.
Senator Udall. Others on the panel, care to comment?
Mr. Cauley.
Mr. Cauley. Gerry Cauley, NERC. I believe that is an
opportunity for us, and I think we do need to expand and grow
our work force in terms of capabilities. It is another example
of an opportunity to partner between Government and industry.
There is a training program at the Pacific Northwest Lab, and
we have been running as many industry folks as we can through
that. It is a very good, week-long program. It is very intense.
But, we need more of that.
Mr. Wilshusen. I would----
Senator Udall. Mr. Wilshusen.
Mr. Wilshusen. Yes, thank you. I would just add that, not
only just within NERC and FERC, but throughout the Federal
Government. We have issued a report earlier this year, too,
about human capital challenges within the Federal Government,
securing Federal systems. Indeed, that is an area that is a
prime consideration and concern.
Mr. Snitchler. Good morning, Senator.
Senator Udall. Mr. Snitchler.
Mr. Snitchler. One of the issues that we have found,
anecdotally, in talking with our utilities in Ohio, is that
they have actively recruited from within the military, and have
had good success with folks who are used to dealing with top
secret clearance and higher on issues that involve issues of
this nature at the utility. They have found that to be helpful.
That being said, they are also at a premium, and it is very
difficult to find sufficient staff. I would agree with the
prior comments about this being an opportunity for specific
work force development that has long-term implications for the
country.
Senator Udall. Mr. Wilshusen, let me turn to you for the
next question.
You talk about the difficulties in the industry of sharing
information on cybersecurity. Could you describe some ways that
you think the electricity industry could improve in this area?
Mr. Wilshusen. Yes, I think there are a couple of areas.
One would be to have a mechanism in place in which the industry
can collect actionable intelligence--or information about
security incidents and vulnerabilities that may be present
within the industry and then being able to share it with other
members, but after it is been anonymized.
Before you came, we talked about the need to anonymize
certain threat information, alert information, so as not to put
other companies in peril. Then, those companies may be more
willing to share information that they may have of any
incidents occurring at their organizations. So, that will be
one key area.
Another is, to receive information from Federal sources and
through NERC and FERC; particularly, getting additional
information through the intelligence community, through
Department of Homeland Security, on threats that are occurring
and vulnerabilities that are happening within those particular
industries.
Senator Udall. Let me follow that up. In Colorado, we have
the Western Cyber Exchange, which is a public-private
partnership, and it works on a regional geographic basis, both
on improving cybersecurity, and then on incident response.
Do you think regional cross-sector models like this are
something we could encourage and should encourage?
Mr. Wilshusen. I think they serve their place. You know,
regional would help. But many of the threats are international
in scope and come from other sources from which regional
utilities--or groups may not have that information. That is why
it is important at the Federal level, at least, threat
information, alert information from the intelligence community,
through DHS, be shared with those particular groups.
Senator Udall. Mr. Cauley or Mr. Snitchler, would you care
to comment on that question, as well?
Mr. Cauley. Yes, sir. We have the Information Sharing
Analysis Center, and what I think we are trying to create is
hubs of information connected to other hubs. So, ours is
focused on the power system in North America, but we are
connected to intelligence agencies, U.S.-served and other--the
NCICs, who are plugged into these other sources, and we share
information with our members in North America.
I think the one other thing that we could do better is to
have more access to clearances, and to create what I would call
``fusion centers,'' perhaps in cooperation with the FBI local
offices, regional offices, where we can quickly get very
detailed information at the classified level to people in
industry who can understand, at a very granular level, what is
the threat, and what actions should I take. That is an
opportunity for us to think about.
Mr. Snitchler. Senator, I think I would echo the comments
from the GAO, where actionable information that has been
sufficiently anonymized would be helpful, because the issue
that we often hear is the question of, If I provide
information, will this later be used against me? If it is,
obviously, they are reluctant to share that information.
Frankly, if we get into a situation where we have a better
way to exchange information, we can be implementing best
practices and avoiding each individual company's having to
uncover and discover the same problem and work their own
solution, but would then have, in effect, a clearinghouse of
known issues. Then, they could work to solve that with the
flexibility within the standard that may be required.
Senator Udall. Thank you all, again, for appearing and
discussing this very important topic.
Thank you, Mr. Chairman.
The Chairman. Senator Coons.
Senator Coons. Thank you, Chairman Bingaman.
Senator Bingaman, you have been beating the drum on this
issue for some time now, and I was happy to join you last year
in supporting the Grid Cyber Security Act.
I am grateful to you and to Senator Murkowski for convening
this panel into taking another look at where we stand and what
we and Congress have to do in order to raise the baseline for
cyber defense in this most important sector for the American
economy and the American people.
Since we met on this topic a year ago, cybersecurity has
become one of the most talked about challenges facing our
Nation. Everyone, from the Secretary of Defense, who has said
the next Pearl Harbor will be in cyberspace and is coming, to
individual business leaders, have warned that the Nation as a
whole faces a real threat, which Members of Congress need to
work together to address.
There is very few issues I lose more sleep about than our
cyber vulnerabilities, and when I speak to experts, they simply
cause me to lose even more sleep. So, I appreciate the
opportunity to reduce my sleep opportunities further today.
To Mr. Wilshusen of GAO; forgive me. Your written testimony
said that when the GAO looked at the security of utilities, you
concluded that, overall, they were focusing on regulatory
compliance, more than a comprehensive security. I think that's
a quote.
Can you elaborate about more--more on what about the
existing approach, in fact, leads to standards becoming a
ceiling, instead of a floor, for the level of cybersecurity,
and what we could do in terms of standard-setting and internal
partnerships that would strengthen an approach to comprehensive
security, rather than mere compliance?
Mr. Wilshusen. I think that one of the dangers when
organizations just focus on mere compliance is that they don't
take an overarching view and develop a comprehensive program
for assessing the risks and taking the appropriate steps to
assure that they cost-effectively address those risks and
mitigate them to an acceptable level.
I think it is still important, though, that you do have
standards or minimum baselines of security controls that can be
consistent across a wide group of similar organizations,
perhaps, an industry, taking into account that each entity may
have separate risks and controls in place to help mitigate
those risks.
So, it is going to be important that each agency have an
effective program for assessing the risk and then taking the
appropriate steps to implement the appropriate controls to
mitigate that. That would include, not only just assuring
compliance with standards, but also taking other actions as
determined necessary in the facts and circumstances.
Senator Coons. If there were to be standards that were
negotiated--that were agreed to between industry and regulatory
agencies, for an area like cyber, where the threat seems to be
rapidly evolving, how would you update, routinely, those
standards in a way that contributed to actual comprehensive
security; how would you do that in a way that balances the
economic impact, the cost, with promoting and achieving actual
security?
Mr. Wilshusen. I think one way is, first off, with the
standards. They need to be at a sufficiently high level to
where they are flexible enough to allow for movement in the
implementation of controls to address emerging threats and
vulnerabilities that occur.
So, it really gets back to each agency or organization
being able to determine what its risks are, and then take the
appropriate controls to mitigate them. At the same time, there
needs to be a level of standards, such as the CIP standards,
and probably have those evolve as going through the current
process, to address new technologies and vulnerabilities that
occur.
Senator Coons. Mr. Cauley, at NERC, you discussed that your
biggest concern is a coordinated, actual physical and cyber
attack, and that, perhaps, the combination of a terrorist
attack in the physical world, followed by an attack that then
takes down some critical infrastructure, such as the electric
grid. I happen to agree that a cyber attack of this kind would
be particularly dangerous. I would be interested in what sorts
of public-private partnerships NERC is engaging in to prepare
with or promote relationships with local and State responders
to help mitigate those threats, and I would interested in where
you hope to expand on those partnerships in the future.
Mr. Cauley. Thank you, Senator.
We do work closely with State and local agencies, in terms
of informing them what we are doing on the system and
vulnerabilities. One of the most concerns that we have is any
challenge that would do any permanent damage to equipment, so
we work closely with law enforcement, FBI, in terms of securing
the physical assets and investigating issues that come up with
breaches and entry into substations and equipment, things like
that.
So, I think there is an opportunity to continue working on
that and expand that, in terms of types of scenarios--of attack
scenarios we might see and run through drills and sort of
understand our communications: who has responsibilities; how do
we need to move personnel from point A to point B and move
equipment; and those kinds of things. So, it's still an
opportunity for us to continue working and developing.
Senator Coons. Broadly, how would you appraise the
capabilities and the preparedness of State and local first
responders, law enforcement, emergency management agencies, to
deal with this sort of a combined attack or the emerging
threats of cyber?
Mr. Cauley. I think we certainly see a lot of experience
and practice there that gives us some confidence--when we have
major storms come through, trees are down, and roads are
blocked. A lot of the capabilities that come into play during
an attack on the grid would be similar to those kinds of
things. So, in terms of securing people, moving people,
securing supplies, those kinds of things, I am confident in the
capability of the local and regional law enforcement and first
responders.
Senator Coons. Thank you.
Mr. Snitchler, at the utility, the PUCO that you are now a
chair of, I was heartened in your prepared testimony to hear
that you addressed the importance, not only of public-private
partnerships, but also Federal-State. I agree, since, in any of
the scenarios we have been discussing, it is likely to be State
and local responders who bear a lot of the responsibility, are
likely to be first on scene, or likely to be leading the
recovery effort.
Now, but on an issue like cyber that doesn't respect
traditional, internal political boundaries or planning
processes, how do you avoid wildly different standards that
lead to uncertain and unreliable security situations or
potentially to overinvestment in security that puts too much of
a burden, in terms of the operating costs of utilities?
Mr. Snitchler. Senator, I think you have hit on the--one of
the primary issues that we often face at the Commission, which
is, What is the appropriate cost and what can consumers and
businesses afford to pay, in order to have the safe, reliable
system that they have come to expect? Certainly, we try to
approach that, being mindful--as I put in my written
testimony--about protecting those critical assets, determining
what those are, those are your diamonds, and giving them the
appropriate level of protection, and then, having your--I hate
to use the term ``less valuable'', but those that perhaps are,
for example, a transformer on a street as opposed to a
substation that is going to power several city blocks. You
would treat those two differently. As a result, you would make
your investments in how you would want those to be treated
differently.
To move back to your first question, to address how do
you--I think what you are asking is how do you not end up with
a litany of ways for States to address these issues, when you
have one issue that may be a national security issue or an
attack on the country. I think you have to look at threats
versus vulnerabilities. I think where you have a threat that
has the ability to impact the entire country or a substantial
region, then, certainly, there is a definite need for Federal
involvement to be able to address those types of concerns.
Where you have got a more localized issue or a
vulnerability that could be exploited, then, certainly, there
is a role for State commissions--the utilities and the State
government, in general--to deal with those concerns. I think it
is a little bit fact-specific, depending on exactly what the
scenario you are describing is; but, certainly, it is not a
good idea to have 51 different ways for us to evaluate a
problem. But, I think if you break that problem down into a
threat versus vulnerability, and then categorize or prioritize,
you can arrive at a more comprehensive way of evaluating those
issues.
Senator Coons. Mr. Snitch, excuse me, Mr. McClelland, if I
might, for a last question.
I just would be interested in your level of confidence that
we have got the information sharing and the collaboration in
place to allow State and local operators to distinguish between
an unexpected outage, a rolling brownout, an equipment
malfunction, and something that, in fact, has originated as a
attack on the Nation, and then, to share relevant information
in real time.
Mr. McClelland. Thank you, Senator.
There is certainly room for improvement. I think the
important aspect is that the interconnections are very large;
there are multiple States within the interconnections. Because
it is a network, and a tightly integrated network, the actions
or inaction of any particular player can have a substantial
impact on the rest of the interconnection.
So, going back to your prior question, I think it is
important that the entities communicate, that minimum standards
be put into place. A minimum in security is a tricky business.
Now, you mentioned before about, you know, sort of, what
are the costs economically to put the standards in place or to
put these protocols in place. But the world moves on, and it is
a very small place. What we are seeing is, you know, folks from
around the world having access--or potential access to SCADA
systems. You can no longer live in isolation.
So, the question would be, What are the adequate security
provisions that an entity must have to protect its business,
and then, how do those practices compare with other practices?
Are we sharing lessons learned? Are we sharing relevant
intelligence? Is it actionable intelligence, so that folks can
see what is happening, they can learn from their neighbor, and
they can put the security in place, because the threats are
moving at lightning speed?
So, as with you, it does keep us up at night. It is
probably the most significant thing that we deal with. It
actually has a potential to become much worse, because, as we
add equipment that was previously dumb equipment and make it
smart equipment, and give it two-way communication, and then
give it the ability to speak with the largest generators on the
system or to have a nexus to the largest generators on the
equipment, then we have introduced a vulnerability. It would be
like on-line banking, without cybersecurity. You really don't
want to go there.
So, I think we are at a point now with the grid and the
changing grid and the cyber connectivity, where no one can live
in isolation. If there is connectivity, there is two-way
communication; there has to be some sort of minimum protocols
and there needs to be sufficient information sharing so that
everyone is able to move ahead with a threat.
Senator Coons. Thank you.
Thank you, Mr. Chairman. Thank you, to the panel.
The Chairman. Senator Murkowski, do you have additional
questions?
Senator Murkowski. I am done, Mr. Chairman. Thank you,
though.
The Chairman. Senator Udall, did you have additional
questions?
Senator Udall. Mr. Chairman, thank you for asking. If I
might. I think much of this could be done for the record, but I
wanted to ask Mr. Cauley what more can we at the Federal level
do to recruit, train, and motivate young people to operate and
defend our critical infrastructure, like the electric grid?
Mr. Cauley. Senator, you know, I think by its--by the very
attention and focus that we are putting on this, I think we are
creating sort of an attractive arena to go into, and I think,
you know, we are seeing that in some of the schools, as well.
But I think, ultimately, one of the other panelists
mentioned recruiting military and people from Government. I
think we have to recognize that the--sort of, the center of
universe intelligence and security state-of-the-art is in the
Government and in the military, and to the extent that it is
not just the hiring of the people, but to do training and
development programs and cooperative programs.
You know, I think information sharing and partnering
between Government and industry are the two most important
things we can do, and this is one area where we could do a lot
more, in terms of Government sharing practices, the art and
skill of security management. I think those kinds of things
would be very useful for industry.
Senator Udall. Mr. Snitchler, would you care to comment?
Mr. Snitchler. I would echo the comments from the other
panelists.
Ohio is blessed to have the Wright-Patterson Air Force Base
near Dayton, where we have a substantial military presence, of
course. As a result, we have a large number of military folks
who may be being discharged from the Service and who are able
to move into those positions. But, as I previously noted, even
with that, we still find that there is a shortage. These
skilled professionals, and they are exactly that, are in short
supply and in high demand, and companies are working very hard
to try and find them.
I think one of the other panelists said, we typically end
up raiding somebody else's cupboard to find someone to be able
to fit that need. That has been my experience in talking with
the utilities that we regulate is, that is often times where
they find them. I think a more concerted effort to demonstrate
that when you have completed your time of Service, if you want
to move into the private sector, these are some of the avenues
that you can pursue to have a long-term viable career, because
these issues are not going to go away. The skills that they
bring to the table make them immediately valuable to an
organization, and I think that has tremendous value.
Senator Udall. I would note, as I conclude, that I sit on
the Armed Services Committee. We are having some of these same
discussions with the Department of Defense, and they are also
concerned about recruiting young cyber warriors, if you will.
So, I think we have got to really focus on growing the pie,
growing the sense that this is an important career path and
work together, not only with the private sector and the public
civilian sector, but also the Department of Defense.
I look forward to working with all of you in that regard.
Thanks, again, for your testimony. It is very helpful.
Thanks.
The Chairman. Yes, thank you very much. I think it has been
a useful hearing.
We will conclude the hearing with that. Thank you.
[Whereupon, at 11:30 a.m. the hearing was adjourned.]
APPENDIX
Responses to Additional Questions
----------
Response of Gerry Cauley to Question From Senator Bingaman
NERC registered entities are required under the currently effective
NERC Critical Infrastructure Protection Standards (specifically
Standard No. CIP-007-3, Requirement 4) to have a malicious software
prevention program to protect critical assets supporting the electric
grid. The standard specifically requires a NERC registered entity to
``use anti-virus software and other malicious software (``malware'')
prevention tools'' (emphasis added) to ``detect, prevent, deter, and
mitigate the introduction, exposure, and propagation of malware.''
Due to the use of the term ``and'', the use of antivirus technology
in a registered entity's malware prevention program appears to be a
minimum requirement for[sic]. However, there are other technologies,
such as whitelisting, that are superior to antivirus in the protection
of these critical assets, but if antivirus is a minimum requirement,
this standard appears to present a roadblock to registered entities
using those newer, superior technologies in malware prevention.
Question 1. Please explain why registered entities should be at
risk for noncompliance and penalties for using a malware prevention
tool other than antivirus.
Answer. NERC has not processed violations for a case as described.
The focus during NERC audits is on assessing how the entities are
handling and mitigating the virus or cyber intrusion risk, and not
strictly on having both methods. NERC's focus is on securing virus and
malware no matter the tools.
Antivirus software is a well-understood protection method, but it
is only one method to detect, prevent, deter, and mitigate the
introduction, exposure and propagation of malware. CIP-007-3 R 4 allows
for and does not prevent the use of additional and alternative methods.
When used, antivirus technologies should be used in conjunction with
other methods, such as whitelisting, file integrity checking, and
computer and network behavior analysis.
Version 5 of the CIP Standards, currently being finalized, requires
that entities ``deploy method(s) to deter, detect, or prevent malicious
code'' and ``mitigate the threat of identified malicious code,'' thus
allowing flexibility by entities to implement the current anti-virus
and/or anti-malware paradigm, implement whitelisting, or choose any
other method so long as it meets the requirement to deter, detect,
prevent, and mitigate threats posed by malicious code.
Responses of Gerry Cauley to Questions From Senator Murkowski
Question 1. A few months ago the White House and the Department of
Homeland Security staged a mock scenario for Senators featuring a
cyber-attack on the grid in New York City. I was disappointed to learn
that neither FERC nor NERC was invited to participate in this exercise,
particularly since at no time during the briefing did the
Administration ever inform members that the utility sector is already
subject to mandatory cyber standards to protect the Bulk Power System
(BPS). Why was FERC not invited to participate in the Administration's
grid cyber-attack exercise? How does FERC interact with DHS in the
cyber arena currently? Is DHS aware of the cybersecurity standards
currently in place for the BPS?
Answer. NERC is unaware of the circumstances regarding why FERC was
not invited to the DHS exercise; NERC is also unaware of FERC's
interaction with DHS in the cyber arena. NERC was not invited to
participate in the White House/DHS/Senate briefings and thus could not
brief Members and staff on the action that Congress took in the Energy
Policy Act of 2005 to address mandatory standards for cybersecurity for
the BPS, and how that authority has been implemented.
DHS is aware that BPS owners and operators are subject to mandatory
cybersecurity standards. In November 2011, NERC hosted the first-ever
sector-specific distributed play security exercise, GridEx, which
involved NERC's mandatory cybersecurity standards. DHS personnel,
including representatives from the Industrial Control Systems Cyber
Emergency Response Team and the Office of Infrastructure Protection
(including the Electricity Sub-sector Specialists), helped plan and
execute GridEx, and participated in it.
In addition to awareness of NERC's standards, DHS is also aware of
Alerts issued by NERC's Electric Sector Information Sharing Advisory
Council (ES-ISAC). NERC and DHS agreed to have ES-ISAC employees staff
the National Cybersecurity and Communications Integration Center, where
the ES-ISAC has access to actionable intelligence, including classified
contextual information available to appropriately cleared staff within
the BPS community. NERC also provides anonymous situational awareness
to DHS analysts to supplement the information DHS received from the
intelligence community. This effort is crucial to improving the level
of threat awareness within the industry and improving information
sharing between government and industry.
As I mentioned in my testimony, NERC regularly interacts with DHS,
partnering on many efforts, including several industry task forces
working to improve security compliance and risk management.
Specifically, DHS participates in the NERC Critical Infrastructure
Protection Committee and the Electricity Sub-sector Coordinating
Council. Additionally, NERC has partnered with DHS for each Cyber Storm
exercise to educate federal partners on the BPS and industry's response
to security threats.
Question 2. Many of the hearing witnesses noted that you simply
cannot protect an entity from all potential cyber-attacks. Mr.
Snitchler from the Ohio PUC cautions that while you can try to ``gold-
plate'' or even ``platinum-plate'' a system, the critical
infrastructure we're trying to protect will become too expensive to
run. Instead, he suggests we prioritize, using a risk-based approach.
Please comment on the issue of cybersecurity costs and the suitability
of using a risk-based approach. Do you agree with Mr. Snitchler that we
should be protecting ``diamonds like diamonds'' and ``apples like
apples''? Is the current FERC/NERC process for addressing cyber
security vulnerabilities risk-based? If not, why not?
Answer. Since becoming President and CEO of NERC, I have
prioritized incorporating a risk based approach to reliability. We are
developing a strong portfolio of standards that address performance,
risk containment, and competency. We are applying a defense-in-depth
strategy that has proven successful in managing risks in critical
sectors, such as nuclear as well as the aerospace industry. I am fully
confident that this approach will work well in managing risks to the
reliability of the BPS.
The NERC CIP Standards have always approached cybersecurity
protection from a risk management basis. Version 4 of the CIP standards
(approved by FERC earlier in 2012) established a set of impact-based
``bright lines'' to remove subjectivity from the process of determining
what BPS components are deemed ``critical.'' Under this paradigm,
industry resources are focused on protecting the BPS components that
have the most impact on reliable operations.
Version 5 of the CIP Standards will have a three-tier approach for
the categorization of critical cyber assets. Under Version 5, industry
resources will still be focused on protecting the components with the
greatest potential to affect the BPS at the highest levels, while
recognizing that the remaining components still contribute to reliable
operations of the BPS, and thus must be appropriately protected.
Question 3. What are NERC's standard operating procedures once it
receives credible threat intelligence that may affect the bulk electric
system?
Answer. NERC's Electricity Sector Information Sharing and Analysis
Center (ES-ISAC) has developed different Alerts to inform industry
about emerging threats. Alerts are different from standards, and can be
developed and issued very quickly, depending on the urgency of the
situation.
Specifically, the ES-ISAC first reviews classified information with
industry subject matter experts (SME) who hold the appropriate level of
security clearances. As a part of the vetting process, a preliminary
saturation and impact assessment determines the relative significance a
compromise of the targeted technology would have on the BPS. Once NERC
and the industry SMEs determine how a compromise may occur and the
potential impact or significance of the compromise, ES-ISAC staff and
industry SMEs develop a draft Alert that contains specific, actionable
information that BPS entities can use to establish a defense against
the threat or help remediate an already existing impact.
This draft Alert, which should be no more sensitive than ``For
Official Use Only,'' is then distributed to a larger technical team of
BPS SMEs called the HYDRA Team. The HYDRA Team is a broad coalition of
industry volunteers with specialties in fields such as transmission,
generation, planning, operations, and cybersecurity of industrial
control systems. Typically, the vendor of the targeted technology is
also involved in the Alert review, as is the vulnerability researcher
who discovered the underlying vulnerability in the technology. Members
of the technical staffs of the DOE, DHS, and the FERC are also members
of the HYDRA Team. They receive draft Alerts and contribute to making
final Alerts valuable for the industry.
The finalized Alert is then sent to both US (including FERC) and
Canadian governmental authorities for their final review and comment.
Thereafter, the Director of the ES-ISAC/Chief Cyber Security Officer
approves the Alert for release to industry. When the Alert is
distributed, it not only goes to NERC's Registered Entities, but also
to other Electricity Sub-sector participants. Alerts may also be
targeted to groups of entities based on their NERC-registered functions
(e.g., Balancing Authorities, Planning Authorities, Generation Owners,
etc.). Using this process, NERC has issued an alert in as little as 32
hours after receiving classified information about a threat.
Question 4. On Thursday, July 19, 2012, FERC approved an order that
allows the ERO to fine the Southwestern Power Administration up to
$19,500 for violating two cybersecurity-related reliability standards
in July 2011. Please explain the nature of these cybersecurity
violations. I understand that DOE believes the federal government is
exempt from such penalties under the Federal Power Act. Please specify
for the Committee why the federal government is, in fact, subject to
compliance with the FERC/NERC reliability standards, including
cybersecurity standards.
Answer. The Southwestern Power Administration (SWPA) violated NERC
CIP-004-1 (Cyber Security--Personnel and Training) and CIP-007-1 (Cyber
Security--Systems Security Management). CIP-004-1 sets out requirements
for personnel that have authorized cyber access or authorized
unescorted physical access to Critical Cyber Assets, including
requirements related to personnel risk assessment, training, and
security (including cyber security). CIP-007-1 sets out requirements
related to security systems determined to be Critical Cyber Assets and
other assets within an ``Electronic Security Perimeter.''
Agencies and instrumentalities of the federal government that are
users, owners and operators of the bulk power system (such as the
Tennessee Valley Authority and the Bonneville Power Administration) are
subject to compliance with the FERC/NERC Reliability Standards,
including cybersecurity standards. DOE has recognized that such
entities are subject to the Reliability Standards, but it has taken the
position that neither FERC nor NERC may impose financial penalties on
those entities for violation of the standards.
By way of background, Section 215(c) of the Federal Power Act
(FPA), 16 U.S.C. Sec. 824o(c), authorizes FERC to certify and oversee
an electric reliability organization (ERO) responsible for developing
and enforcing mandatory Reliability Standards that are applicable to
all users, owners and operators of the Bulk-Power System (BPS). FERC
certified NERC as the ERO in 2006,\1\ and has since approved over one
hundred national Reliability Standards as mandatory and enforceable,
pursuant to FPA Section 215(d).
---------------------------------------------------------------------------
\1\ North American Electric Reliability Corp., 116 FERC Sec.
61,062, order on reh'g and compliance, 117 FERC Sec. 61,126 (2006),
order on compliance, 118 FERC Sec. 61,190, order on reh'g 119 FERC
Sec. 61,046 (2007), aff'd sub nom. Alcoa Inc. v. FERC, 564 F.3d 1342
(D.C. Cir. 2009).
---------------------------------------------------------------------------
FPA Section 215(b) (1), ``Jurisdiction and applicability,''
describes FERC's reliability jurisdiction as follows:
The Commission shall have jurisdiction . . . over . . . all
users, owners and operators of the bulk-power system, including
but not limited to the entities described in section 201(f) . .
. for purposes of approving reliability standards established
under this section and enforcing compliance with [FPA Section
215]. All users, owners and operators of the bulk-power system
shall comply with reliability standards that take effect under
this section.
Because they are described in FPA Section 201(f), agencies or
instrumentalities of the United States are expressly included within
the term ``users, owners, and operators of the bulk-power system'' in
Section 215 and made subject to FERC's jurisdiction to both approve and
enforce reliability standards. The requirement in FPA Section 215(b)(1)
that all users, owners and operators of the bulk-power system must
comply with reliability standards that take effect under Section 215
thus applies to Federal entities.
In orders issued since 2009, FERC has held consistently that a
federal entity that uses, owns or operates the Bulk-Power System must
comply with mandatory Reliability Standards.\2\ Most recently, in its
July 19, 2012 order, FERC found that Section 215 explicitly conveys
authority to assess a monetary penalty against a federal entity that is
a user, owner, or operator of the Bulk-Power System for violations of a
mandatory Reliability Standard.\3\ FERC rejected arguments that the
grant of enforcement authority under FPA Section 215 is limited by the
scope of the Commission's general civil penalty authority over federal
entities, as set out in FPA Section 316A, and instead found that the
separate grant of penalty authority over federal entities under FPA
Section 215 is ``explicit and unambiguous.'' FERC found that this
penalty authority under FPA Section 215(e) applies to both the ERO and
the Commission.
---------------------------------------------------------------------------
\2\ North American Electric Reliability Corp., 129 FERC Sec.
61,033 (2009) (2009 Jurisdictional Order), reh'g denied, 130 FERC Sec.
61,002 (2010); North American Electric Reliability Corp., 133 FERC
Sec. 61,214 (2010), reh'g denied, 137 FERC Sec. 61,044 (2011).
\3\ North American Electric Reliability Corporation, 140 FERC Sec.
61,048 (2012).
---------------------------------------------------------------------------
Response of Gerry Cauley to Question From Senator Barrasso
Question 1. In your testimony, you encourage Congress to
``facilitate information sharing between the public and private
sector.'' You recommend ``making more clearances available to industry,
identifying alternative methods to communicate classified information
to our Canadian partners, and encouraging increased information sharing
by US Government departments and agencies with asset-owners.'' Would
you please expand upon the steps Congress should take to facilitate
information sharing between the Federal government and industry?
Answer. The most important action that can be taken to address
cybersecurity is improving information sharing. Improved information
sharing depends on a fundamental understanding by government that the
private sector owners and operators of the BPS need to know as much as
possible about a threat, as soon as possible, so that they can take the
appropriate action. The owners and operators of the BPS know their
systems and the consequences that actions taken in one part of the BPS
may have for another part. They cannot merely be told that there is a
threat; they must be provided with sufficient information about the
threat so that proper mitigation measures can be developed. In NERC's
experience, this has been difficult for government security
professionals to understand. As I noted in the hearing, it took more
than three years to get actionable information from the government on
the Aurora vulnerability. Once that information became available in a
form that NERC could share with industry, NERC issued an Alert to
industry, and industry then began developing mitigation plans.
Any action Congress can take to make more secret-level clearances
available to the Electricity Sub-sector would assist in information
sharing efforts. Individuals from the Electricity Sub-sector should be
able to access and analyze classified information and share it among
other cleared partners. In addition, in the instance of a cyber attack,
these individuals should be assured that they have access to local
secure centers, such as fusion centers or local Federal Bureau of
Investigation offices.
Continued support for NERC's existing cybersecurity efforts,
including NERC standards and the Electricity Sector Information Sharing
and Analysis Center (ES-ISAC), the Electric Sector Coordinating Council
and NERC's grid security exercise and conference, which provide forums
for improving information concerning cybersecurity among the public and
private sector, is appreciated. NERC's ES-ISAC is one of the most
effective tools NERC has to inform industry about emerging
cybersecurity threats through Alerts. As I mentioned in my testimony,
the ES-ISAC partners with several industry and government organizations
to not only share critical cyber information, but to also develop these
Alerts.
Also, reflecting the international nature of the BPS, NERC is
responsible for ensuring the reliability of the BPS within the US and
Canada. Currently, NERC is unable to share sensitive information
regarding cyber threats or vulnerabilities with our Canadian partners.
We are aware that the government has mechanisms in place to facilitate
government-to-government information sharing at classified levels.
Further work needs to be done to facilitate information sharing with
industry officials in Canada, as well.
______
Responses of Joseph McClelland to Questions From Senator Bingaman
Question 1. You testify that the majority of the Directives that
FERC issued in Order No 706 have yet to be addressed. Could you
describe some of the most important of them?
Answer. First, the Commission directed NERC to develop a process of
external review and approval of critical asset lists in order to ensure
that the proper assets were consistently covered by the CIP standards
under a system that depends on the entities to self-designate their
equipment. In Order No. 761, the Commission stated that the adoption of
appropriate, bright line criteria for Critical Asset identification may
obviate the need for an external review. However, as stated in that
order, whether this development ultimately eliminates the need for an
external review process as directed in Order No. 706 will depend on the
discretion allowed to individual registered entities to self-identify
and characterize assets or systems for critical infrastructure
protection to support the nation's bulk-power system. It also will
depend on whether the bright line criteria generally include adequate
facilities. Second, Order No. 706 directed the ERO to require immediate
revocation of access privileges when an employee, contractor or vendor
no longer performs a function that requires physical or electronic
access to a critical cyber asset for any reason (including disciplinary
action, transfer, retirement, or termination).
Question 2. Some have argued that FERC has the authority to order
NERC to produce a fairly specific standard. Could you do so, and if you
did what would be the process then?
Answer. The Commission can direct NERC to develop a reliability
standard to address a specific reliability matter. However, the
Commission cannot ensure that the content of the standard returned to
it by NERC will adequately respond to the specific reliability matter
as the Commission may not directly author or modify a reliability
standard under section 215. Under section 215, reliability standards
must be developed by the ERO through an open, inclusive, and public
process. The NERC process is intended to develop consensus on both the
need for, and the substance of, the proposed standard. Although
inclusive, the process is relatively slow, open and unpredictable in
its responsiveness to the Commission's directives.
Responses of Joseph McClelland to Questions From Senator Murkowski
Question 1. A few months ago the White House and the Department of
Homeland Security staged a mock scenario for Senators featuring a
cyber-attack on the grid in New York City. I was disappointed to learn
that neither FERC nor NERC was invited to participate in this exercise,
particularly since at no time during the briefing did the
Administration ever inform members that the utility sector is already
subject to mandatory cyber standards to protect the Bulk Power System
(BPS). Why was FERC not invited to participate in the Administration's
grid cyber-attack exercise? How does FERC interact with DHS in the
cyber arena currently? Is DHS aware of the cybersecurity standards
currently in place for the BPS?
Answer. I do not know why the Commission was not involved in this
exercise. That question is best answered by those who organized the
exercise.
With respect to the Commission's interaction with DHS, Commission
staff works closely with the DHS both on an informal basis and through
formalized processes such as the Industrial Control Systems Cyber
Emergency Response Team (ICS-CERT), the Cyber Unified Coordination
Group, and the National Protection and Programs Directorate at DHS.
Commission staff meets monthly with the Nuclear Regulatory Commission
(NRC), Federal Bureau of Investigation (FBI), and the Department of
Energy (DOE) at the Top Secret/ Sensitive Compartmented Information
level to discuss events and threats. Meetings with ICS-CERT are also
conducted as required to discuss imminent threats and events that could
impact the security of the electric grid. The meetings take place so
the ICS-CERT can provide guidance to entities on how to address these
issues.
Question 2. Many of the hearing witnesses noted that you simply
cannot protect an entity from all potential cyber-attacks. Mr.
Snitchler from the Ohio PUC cautions that while you can try to ``gold-
plate'' or even ``platinum-plate'' a system, the critical
infrastructure we're trying to protect will become too expensive to
run. Instead, he suggests we prioritize, using a risk-based approach.
Please comment on the issue of cybersecurity costs and the suitability
of using a risk-based approach. Do you agree with Mr. Snitchler that we
should be protecting ``diamonds like diamonds'' and ``apples like
apples''? Is the current FERC/NERC process for addressing cyber
security vulnerabilities-risk based? If not, why not?
Answer. In general, the use of a risk-based approach to identify
assets that are critical to the operation of the Bulk Power System can
be suitable. The cost of cyber protection must be considered against
both the effectiveness of the measures and the impact that the
facilities in-question can have on the reliability of the Bulk Power
System. However the designation of ``diamonds'' does not just depend
upon the size or expense of the equipment, but also depends upon the
connectivity of the equipment, whether it can be compromised and, in
turn, be used to compromise other equipment that may alone or in
aggregate successfully compromise the operation of the Bulk Power
System or the customers it serves.
The currently applicable CIP standards include a risk-based
methodology to determine which facilities are ``critical assets and the
associated critical cyber assets,'' and therefore are subject to the
requirements of the CIP reliability standards. However these standards
allow utilities significant discretion to determine which of their
facilities fit that description. The recently-approved Version 4 CIP
Reliability Standards, which will go into effect on April 1, 2014,
replace this risk-based assessment with ``bright line'' criteria.
Version 4 relies upon the affected entities to self-designate their
``Critical Cyber Assets''. Only facilities that are self-designated by
the regulated entities as ``Critical Cyber Assets'' are covered under
the CIP standards. In order to help guide their decisions, the CIP
standards identify categories of ``Critical Assets'' as a starting
point in the process. If the entities have any ``Critical Assets''
(i.e., such as generating stations at 1500 MW or above, reactive power
supplies at 1000 MVAR or above, transmission facilities at 500 kV or
above, etc.), they are then required to determine if they have any
``Critical Cyber Assets'' at these facilities and if they decide that
they do, those facilities will fall under the CIP standards. Entities
can only designate ``Critical Cyber Assets'' from the ``Critical
Asset'' list.
In Order No. 761, the Commission supported the application of the
tiered-approach in the National Institute of Standards and Technology
(NIST) Framework. That framework would, among other things, (1) ensure
that all Cyber Systems associated with the Bulk-Power System, based on
their function and impact, receive some level of protection; (2)
customize protection to the mission of the cyber systems subject to
protection; and (3) apply a tiered approach to security controls that
specifies the level of protection appropriate for systems based upon
their importance to the reliable operation of the Bulk-Power System.
The Commission stated that incorporating these applicable features of
the NIST Framework into the CIP Reliability Standards would be a
positive step in improving cyber security for the Bulk-Power System. In
addition to considering the NIST Framework, the Commission in Order No.
761 stated that the criteria adopted for the purpose of identifying
Critical Cyber Assets should include a cyber asset's ``connectivity''
and its potential to compromise the reliable operation of the Bulk-
Power System. Therefore, we expect Version 5 to address these issues.
NERC, in its comments to the CIP Version 4 proceeding, stated that it
is incorporating into the Version 5 CIP Reliability Standards the NIST
risk-based approach.
Question 3. We hear a lot about the potential benefits from smart
grid systems, including reduced rates and improved reliability.
However, we're starting to hear more about an unintended consequence
from smart grid systems--namely that the smart grid's reliance on IT
systems and networks exposes the electric grid to cybersecurity
vulnerabilities which could be exploited by attackers. In the 2007
energy bill, Congress directed NIST to develop smart grid
interoperability standards that FERC would later adopt. I understand
that while NIST has developed these standards, FERC has not yet taken
action because of a lack of consensus on the standards.
a. The 2009 stimulus bill provided over $4 billion in smart
grid funding before these NIST interoperability standards were
even developed. In fact, the stimulus bill provided $10 million
in funding for NIST to perform the standard development work.
What cybersecurity protections were included in the smart grid
assets purchased with stimulus money? Doesn't it cost more to
implement security after the network is already up and running?
Answer. I do not know what cyber security protections were included
in any assets purchased with the stimulus money, since this program was
administered by the Department of Energy. Generally, it costs more and
may be less effective to implement security after a network is
installed.
b. GAO has previously suggested that FERC monitor industry
compliance with NIST's voluntary smart grid standards. Has the
Commission done so? If not, why not? What is FERC doing in the
smart grid arena with regard to cybersecurity standards?
Answer. The Commission has not monitored compliance with NIST's
voluntary smart grid standards. Much of the smart grid involves
facilities used in local distribution, which are not under the
Commission's Federal Power Act (FPA) jurisdiction. However, Commission
staff attends and observes meetings of the NIST Cyber Security Working
Group, Smart Grid Task Force, and participates in a collaborative with
the National Association of Regulatory Utility Commissioners concerning
the smart grid. Commission staff also regularly performs outreach to
NIST and the Smart Grid Interoperability Panel and is following the
development of smart grid standards. Commission staff also monitors
developments of the North American Synchrophasor Initiative (NASPI)
relative to applicable cyber security standards. Lastly, pursuant to
its FPA 215 responsibilities Commission staff attend and participate in
the NERC standards development process--including the CIP standards.
Commission staff offers guidance that can include information relevant
to the smart grid.
Question 4. You testified that because FERC's Federal Power Act
authority does not extend to local distribution facilities there may be
some ``significant facilities [that are] vulnerable to the threat of a
cyber or physical attack.'' Mr. Snitchler's testimony included a
snapshot of state actions, including those undertaken in New York, that
demonstrate a proactive stance on cyber security. Are there particular
cities or local facilities where FERC is concerned no action has been
taken by your state counterparts to protect their distribution system
from cyber incursions?
Answer. I cannot identify specific cities or local facilities where
no action has been taken by the states but am aware of the types of
risks which such facilities might be facing.
Question 5. Throughout your testimony you note your frustration
with the time it takes for NERC and its stakeholder process to develop
these cybersecurity standards. However, NERC filed its enhanced
Critical Cyber Asset Identification Standard (CIP-002 version 4) with
the Commission in February 2011 and it took FERC a full 14 months to
approve that revision. Why is it taking so long for the Commission to
act on such filings and what can the Commission do by way of
improvement?
Answer. In general, the Commission could shorten the time to
process the NERC filings using an Order versus a Notice of Proposed
Rulemaking (NOPR). The NOPR process requires the Commission to propose
Commission action on the standard. The Commission must then solicit
comments on the NOPR and issue a Final Rule on the proposed standard.
Although longer, the NOPR process allows for open communication between
the Commission and the commenters including opportunities for meetings
between Commission members and individual stakeholders and industry
interest groups on the Commission's proposed dispositions. Because the
Commission may not directly author or modify a reliability standard
under section 215, the NOPR process is the most effective way to detail
the Commission's concerns regarding a proposed reliability standard
before issuing a final rule regarding that standard. In Order No. 693,
the Commission stated that it anticipates that it will address most, if
not all, new Reliability Standards proposed by NERC through the more
open rulemaking process which has been strongly preferred by industry.
Additionally, the CIP cyber security standards are extremely technical
and it takes both the Commission time to appropriately analyze them and
the industry time to prepare its comments to the Commission proposed
rule. These procedures, which ensure the Commission has a sufficient
record on which to act on the technical aspects of the cyber security
standards, take time to implement.
Specifically with respect to the Version 4 standards, on February
10, 2011, NERC filed a petition seeking Commission approval of the
Version 4 CIP Reliability Standards. On April 12, 2011, Commission
staff issued a data request to NERC in order to receive supplemental
information necessary to understand the filing because the filing
lacked information necessary for the Commission to process them. On
April 13, 2011, NERC requested an extension of time to respond to a
portion of the Commission's April 12, 2011 data request. The Commission
granted this request, and NERC provided the information on May 27, 2011
and June 30, 2011. The Commission issued the Notice of Proposed
Rulemaking September 15, 2011 and allowed 60 days from publication in
the Federal Register for the industry to comment, or November 21, 2011.
The Commission then issued the final rule on April 19, 2012, 150 days
later, after reviewing comments from 28 entities and reply comments
from NERC.
Question 6. The electricity sector has told us that what it needs
in the event of a cybersecurity emergency is timely, specific, and
actionable information. Does FERC agree? What do the words ``timely,
specific and actionable'' mean to FERC?
Answer. I agree with this statement. I believe that ``timely,
specific and actionable'' means that, to prevent a significant risk of
disruption to the grid, the information should allow mitigating action
to be taken before a cyber security event. Because cyber events have
the ability to compromise multiple systems simultaneously, both
prevention and quick intervention are keys. Sufficient and accurate
information about both the vulnerability and the targeted systems must
be available to develop specific details regarding how to defend,
mitigate, or eradicate a cyber attack as quickly as possible, which may
require pre-emptive mandatory actions in order to be effective.
Specific and actionable means that the information must be detailed in
a manner for the owner/operators to be able to quickly apply the
mitigations to the equipment allowing for prevention or mitigation of a
cyber attack.
Question 7. On Thursday, July 19, 2012, FERC approved an order that
allows the ERO to fine the Southwestern Power Administration up to
$19,500 for violating two cybersecurity-related reliability standards
in July 2011. Please explain the nature of these cybersecurity
violations. I understand that DOE believes the federal government is
exempt from such penalties under the Federal Power Act. Please specify
for the Committee why the federal government is, in fact, subject to
compliance with the FERC/NERC reliability standards, including
cybersecurity standards.
Answer. That order is subject to rehearing, so I cannot comment at
this time on the issues presented in the proceeding. For your
convenience, attached is the Commission's order in that proceeding.
Responses of Joseph McClelland to Questions From Senator Barrasso
In your testimony, you state that ``[t]he Commission is committed
to protecting the reliability of the nation's bulk electric system.''
However, I am concerned that the Commission, under Chairman
Wellinghoff, has downplayed the cumulative impact of EPA's new and
proposed regulations on electric reliability. On May 17, 2011, Senator
Murkowski sent a letter to Chairman Wellinghoff inquiring about the
impact of EPA's regulations on reliability. Commissioner Norris has
testified that he had three conversations last year with Heather
Zichal, Deputy Assistant to the President for Energy and Climate Change
Policy, ``regarding FERC staff's review of EPA regulations.''
Commissioner Norris testified that Ms. Zichal contacted him on two
occasions--in late June or July of 2011--``for information on the
timing of the FERC studies on the reliability impact of the pending EPA
Rules and the timing of FERC responses to Sen. Murkowski's questions to
the Commissioners.'' Notably, Chairman Wellinghoff and Commissioners
Norris and LaFleur did not respond to Senator Murkowski until August 1,
2011--more than two months after receiving the Senator's letter. In
their response, the Chairman and Commissioners Norris and LaFleur
revealed that your staff had--after almost one year--completed only an
``informal assessment'' of the impact of EPA's regulations on
reliability. Your staff's analysis found that as much as 41 GW of coal-
fired generating capacity was ``very likely'' to retire, with another
40 GW ``likely'' to retire, on account of EPA's regulations. On
September 14, 2011, Chairman Wellinghoff testified before the House
Subcommittee on Energy and Power and characterized your staff's
analysis as ``back-of-the-envelope.'' However, your staff's analysis,
as far as I can tell, is turning out to be a reasonably accurate
prediction of the retirements. I am concerned that it took an inquiry
from this Committee to bring your staff's analysis to light. I am also
concerned about the timing of that analysis.
Question 1. Have you or any member of your staff had any direct or
indirect contacts or exchanges, in person, by telephone, electronic
mail, or otherwise (e.g., together with or in the company of the
Chairman or any Commissioner(s)), with Ms. Zichal or anyone in the
Executive Office of the President (EOP) about the potential impact of
EPA's regulations on electric reliability or on any other subject
(e.g., the ``informal assessment'' as Chairman Wellinghoff used the
term in his correspondence with Senator Murkowski, or ``FERC staff's
review'' or ``FERC studies'' as Commissioner Norris used the terms in
his testimony)? If so, please list the dates the contacts or exchanges
took place and provide the names and titles of the individuals involved
in these contacts or exchanges.
Answer. To the best of my knowledge, neither I nor my staff has had
any direct or indirect contacts with Ms. Zichal or anyone in the
Executive Office of the President on these issues, except as noted in
the Chairman's response to Senator Murkowski's May 17, 2011 letter.
Question 2. What was the purpose and the subject matter of the
contact(s) or exchange(s) you have identified in question 1?
Question 3. Have you or any member of your staff advised or
provided any information to the Chairman or any of the Commissioners in
connection with any contact or exchange (to include, as in question 1
above, in person, by telephone, electronic mail, or otherwise) that the
Chairman or any Commissioner may have had with Ms. Zichal or others in
the EOP? If so, (a) what was the purpose and the subject matter of the
advice or information you or your staff gave to the Chairman or
Commissioner(s) in connection with contacts or exchanges with Ms.
Zichal or others in the EOP; and (b) please list the dates the contacts
or exchanges took place and provide the names and titles of the
individuals involved in these contacts or exchanges.
Answer. No
______
Response of Todd A. Snitchler to Question From Senator Bingaman
Question 1. Mr. Wilshusen has recommended that FERC coordinate with
the states and other nonjurisdictional entities (such as Coops or
munis) to evaluate the extent to which utilities are complying with
voluntary standards and to develop strategies for addressing gaps in
compliance. Does that sound like a recommendation that you would
welcome? Would it work, given the splits in jurisdiction, differences
in state laws and regulations and the fact that many entities are
jurisdictional neither at the state or federal level?
Answer. Recognition must be given that voluntary standards are,
indeed, voluntary. By requiring utilities to develop strategies for
addressing ``gaps in compliance'', these ``voluntary'' standards then
become ones which are mandatory. I do not believe we are all (FERC,
states, utilities) in agreement with respect to mandatory standards or
which standards, if any, ought to be mandatory. However, I believe that
there could be benefits to having increased coordination between the
states, non-jurisdictional entities, jurisdictional utilities, and the
federal government in addition to the existing FPA Sec. 215 process. A
collective meeting of the parties would be useful in sorting out and
resolving these issues.
Response of Todd A. Snitchler to Question From Senator Murkowski
Question 1. You note that the Ohio PUC has worked closely with the
Wright Patterson Air Force Base. What can you tell us about your
state's efforts in working with the military?
Answer. The Public Utilities Commission of Ohio has met with Wright
Patterson Air Force Base (WPAFB) representatives on a variety of topics
and issues over the years. Our staff addressed WPAFB representatives on
energy assurance issues back in 2009. At that time, the PUCO encouraged
WPAFB personnel to engage in meaningful discussions with their local
electric utility regarding the specific needs and concerns for base
operations, enhanced reliability requirements, and mitigating threats
to these enhanced reliability requirements (including generation/
supply, distribution/delivery, and system security--physical as well as
cyber). Also at that time, the PUCO offered to facilitate those
discussions, but was assured that appropriate base personnel would work
directly with the appropriate utility personnel on these issues.
Subsequently, the PUCO extended an invitation to WPAFB representatives
to participate in Ohio's Energy Assurance tabletop exercise conducted
in June 2011; a major component of the event featured a cybersecurity
panel discussion with representatives from: the U.S. Department of
Energy's Cybersecurity for Energy Delivery Systems (CEDS) program; the
Supervisory Special Agents for the Cyber Squads in the Cincinnati and
Cleveland Divisions of the U.S. Federal Bureau of Investigation; a
Cyber Security Advisor from the U.S. Department of Homeland Security's
National Cyber Security Division; the two Protective Security Advisors
from the U.S. Department of Homeland Security's Office of
Infrastructure Protection which serve the State of Ohio; and Ohio's
Homeland Security Advisor. Additionally, the PUCO met with
representatives from the electric utility serving WPAFB as early as
2009 to discuss the utility's cybersecurity program and posture.
The PUCO also was instrumental in working with the U.S. Air Force
at WPAFB to eliminate our nation's, and especially our military's,
dependence on foreign oil. Research into synthetic fuel from domestic
coal, shale, biomass, and other sources using the Fischer-Tropsch
process in order to reduce our dependence on foreign oil and achieve
greater price stability has resulted in the creation of the Assured
Aerospace Fuels Research Facility (AAFRF). This lab was created to
perform essential research and development of these coal-to liquid,
biomass-to-liquid, and shale-to-liquid synthetic fuel technologies. It
serves as an excellent research tool for professional researchers from
government, academia, and industry as well as training grounds for
creating skilled operators, technicians, and researchers for future
commercial facilities.
Responses of Todd A. Snitchler to Questions From Senator Barrasso
Question 1. In your testimony, you state that ``one-size solutions
for cybersecurity may not be the most effective means to mitigate and
reduce known vulnerabilities.'' Would you expand upon your comments for
the Committee?
Answer. Broad-based principles regarding good cybersecurity
practices may be more appropriate for utility applications. Industrial
Control Systems (ICS) and Supervisory Control And Data Acquisition
Systems (SCADA) tend to be very specialized equipment monitoring and
controlling extremely complex networks. What may be considered a best-
practices approach for one control system may not function as a best-
practices approach for a different control system. The existing
differences in approaching cybersecurity utilized by the utilities and
also the RTOs actually has a positive effect in that an attack on one
utility's system will not necessarily bring down all systems because
each has its own method of ensuring their cybersecurity. By allowing
disparate approaches to solving the cybersecurity issue, while
establishing the broad based, best practices, we potentially strengthen
defenses against attacks to the grid.
Question 2. In your testimony, you state that ``smart grid
[technology] fundamentally makes the electric system more secure.''
However, you also say that ``this technology brings with it new
vulnerabilities. . .which should be taken extremely seriously.'' Would
you expand upon the vulnerabilities that smart grid technology brings
to our electric grid?
Answer. The ``Smart Grid'' too often is defined as being synonymous
with ``smart meters'' or advanced metering infrastructure (AMI). Other
important portions of the Smart Grid often overlooked include
synchrophasors, protective relays, reclosers, and substation
automation, among others. These components improve fault-detection
capabilities and enable self-healing of the electricity grid. Taken as
a whole, these technologies do make the electric system more secure and
more reliable. The additional vulnerabilities are introduced by
converting previously one-directional flows of power and information to
become bi-directional. As additional points of data collection and
gathering are introduced, so, too, are there additional points where
hackers or other non-native data sources may introduce false
information feeds into the network in an attempt to cause disruptions
or system actions undesirable to the system operators. Finally, each
new potential access point creates a remote source of entry to the
system. It is essential to security protocols that proper backstopping
from those potential entry points ensure that remote access is denied
and the system is able to lock out or compartmentalize the access
points to ensure that access, if secured, can be isolated and prevent
substantial harm to the system.
Question 3. In your testimony, you explain that state regulators
and industry ``are unable to provide the. . .protection necessary to
help secure our nation's critical infrastructure if the relevant
Federal agencies do not provide actionable information to address
imminent threats.'' You go on to say that ``asset owners who provide
information about their systems to Federal agencies in the spirit of
cooperation. . .never receive truly meaningful, actionable, timely
information in return.''
a. Do you know why the Federal government is not sharing this
information with state regulators and industry?
Answer. An often-cited answer is lack of security clearances in
order to share specific threat information with state regulators or
industry. This is understandable for specific threat information.
Present practice provides monthly or intermittent threat briefings to
the electricity sector, yet such threat information is often too stale
or so non-specific as to be un-actionable. Surely an opportunity exists
to provide more timely or actionable information without disclosing
classified information. Addressing this fundamental problem would be a
tremendous help to state regulators and, I expect, to the electricity
industry. For instance, in the case of the ``Aurora'' situation, the
federal government and its regulators in essence told the electric
utility sector, ``we have a secret problem on our hands and we can't
tell you what it is. . . .now go fix it.'' In this specific case, the
government knew of a vulnerability (they created it in a lab), and
wanted that vulnerability addressed yet would not or could not disclose
that information at that time. There must be a way for the federal
government to provide such actionable intelligence in a timely manner
so that those that need to take action know what action to take before
the vulnerability becomes a threat and a threat becomes a tragedy.
b. Do state regulators and industry lack the security
clearances necessary to obtain this information?
Answer. A lack of security clearances by regulators and utilities
often is cited as the primary impediment to sharing of information by
the federal government. However, granting additional regulatory
authority to FERC or another federal agency does nothing to change that
fact. Therefore, it would appear that it might be worth some time
devising a means for the federal government to share relevant,
actionable, and timely information with state regulators and utilities
without divulging the methods or sources by which that information has
been obtained. Additionally, the federal agencies responsible for
providing security clearances should establish a consultative process
with those in the electricity sector (state government and industry) to
identify to whom or to which positions within the industry and/or state
government ought to be provided an opportunity to gain the necessary
clearance and at what level. The agencies should then be instructed to
establish a procedure to thoroughly review and process these requests.
In order to secure timely transfer of information, select members of
state commissions and/or utilities should be considered for security
approval and permitted access to information critical to maintenance
and protection of the grid.
Question 4. In your testimony, you state that ``our utilities can
provide a `gold-plated' or even a `platinum-plated' system which is
ultra-cyber secure.'' However, you go on to ask ``how much more do we
want a kilowatt hour of electricity to cost?'' Would you discuss the
potential impact of new cyber security investments on ratepayers?
Answer. It is difficult to assess a financial cost of cybersecurity
investments imposed by a federal regulatory agency not yet granted the
authority to order such investments. It also is difficult to ascertain
what cybersecurity requirements might be imposed by such a scheme. Yet,
nothing is too expensive for one who doesn't have to pay the bill.
My point is this: there are risks these businesses must manage
everyday in running their utility systems. Cybersecurity is one more of
those risks that must be managed. There is a definite role for the
federal and state governments to assist these critical infrastructures
in securing their networks. But, as stated above, a best-practices
approach for one utility, when applied to another utility, may not have
the same positive impact on that second utility's cybersecurity
posture. In other words, what may be prudent and necessary
cybersecurity infrastructure expenditures for a utility system in
Washington, DC, which houses much of our federal government, may not be
appropriate in Houston, Texas, which houses petroleum refining. And
neither of the appropriate cybersecurity expenditures in those two
instances may be prudent to a utility serving Pleasantville, Ohio. The
opportunity exists for the federal and state governments to ensure
appropriate cost recovery for necessary cybersecurity remediations or
enhancements. Undoubtedly, these utility control systems must become
more secure and resilient; but most beneficial would be federal
guidance to the electricity sector and state regulatory bodies that
would assist us in determining how to best direct scarce resources in
the most cost-effective appropriate fashion to be directed against the
most imminent threats and against the likely vulnerabilities to the
electricity sector.
In the end, we cannot, and we should not, expend resources on every
known vulnerability: it would just be too expensive. For instance, to
use the analogy of physical security, we could place 24-hour manned
guardhouses at the base of each major electric transmission tower in
order to prevent the vulnerability of a terrorist bringing down the
grid with the destruction of multiple towers in several key locations.
However this would be a very expensive solution for a low probability
vulnerability. We must address the cybersecurity threats and
vulnerabilities just as we address the physical security threats and
vulnerabilities to our nation's infrastructure.
Question 5. At what point do the costs and vulnerabilities
associated with smart grid technology outweigh the value for
ratepayers?
Answer. There is no simple answer to the question posed here. The
experience of power outages brought on by storm activity is
fundamentally no different than a cyber attack that may disable the
grid. A cost-benefit analysis must be performed--either explicitly or
implicitly--to ascertain if the costs associated with the risk are
worth the benefit achieved by implementation of the grid.
The self-healing ability of the smart grid, shorter outage times
and increased reliability are all substantial benefits as a result of
the use of the smart grid. Further, in restructured markets customers
have greater access to options to control their utility usage and
control their costs, as well as the increasingly varied pricing options
available are all dependent on the utilization of the smart grid tools.
______
Government Accountability Office,
Washington, DC, August 2, 2012.
Hon. Jeff Bingaman,
Chairman, Committee on Energy and Natural Resources, U.S. Senate.
Subject: Responses to Questions for the Record; Hearing on Status of
Action Taken to Ensure that the Electric Grid Is Protected from Cyber
Attacks
This letter responds to your July 26, 2012, request that we reply
to additional questions arising from the Committee's July 17, 2012,
hearing on the status of actions to protect the electricity grid from
cyber attacks. At the hearing, we discussed (1) cyber threats facing
cyber-reliant critical infrastructures, which include the electricity
grid, and (2) actions taken and challenges remaining to secure the grid
against cyber attacks.\1\ The enclosure provides our responses, which
are primarily based on previously issued products that were performed
in accordance with generally accepted government auditing standards.\2\
---------------------------------------------------------------------------
\1\ GAO, Cybersecurity: Challenges in Securing the Electricity
Grid, GAO-12-926T (Washington, D.C.: July 17, 2012).
\2\ Including: GAO-12-926T; Critical Infrastructure Protection:
Cybersecurity Guidance Is Available, but More Can Be Done to Promote
Its Use, GAO-12-92 (Washington, D.C.: Dec. 9, 2011); Electricity Grid
Modernization: Progress Being Made on Cybersecurity Guidelines, but Key
Challenges Remain to be Addressed, GAO-11-117 (Washington, D.C.: Jan.
12, 2011); Critical Infrastructure Protection: Multiple Efforts to
Secure Control Systems Are Under Way, but Challenges Remain, GAO-07-
1036 (Washington, D.C.: Sept. 10, 2007); and Information Security: TVA
Needs to Address Weaknesses in Control Systems and Networks, GAO-08-526
(Washington, D.C.: May 21, 2008).
---------------------------------------------------------------------------
Should you or your office have any questions on the matters
discussed in this letter, please contact me at (202) 512-6244 or
[email protected] or David C. Trimble, Director, Natural Resources and
Environment, at (202) 512-3841 or [email protected].
Sincerely yours,
Gregory C. Wilshusen,
Director, Information Security Issues.
[Enclosure.]
Responses to Questions From Senator Bingaman
Question 1. You recommend that FERC develop an approach to
coordinate with state regulators and entities that are not subject to
state regulation to evaluate the extent to which utilities and
manufacturers are following voluntary standards, and to develop
strategies for addressing gaps in compliance with standards. What
encourages you to believe that efforts like this could be successful?
Answer. Electricity industry regulation is fragmented, with
oversight responsibility divided among various regulators at the
federal, state, and local levels. Such regulatory fragmentation can
make it difficult for individual regulators to develop an industry-wide
understanding of whether utilities and manufacturers are following
voluntary standards. This is due to the large number of regulators in
the industry-the Federal Energy Regulatory Commission (FERC),
electricity regulators in 50 states and the District of Columbia, and
regulators of thousands of cooperative and municipal utilities-and
their potentially limited visibility over parts of the grid outside
their jurisdiction. This complex reality of electricity regulation led
us to believe that a coordinated approach to monitoring whether
utilities and manufacturers follow voluntary standards would be more
successful than an approach in which one or more regulators attempted
such an assessment on its own. We are encouraged by the fact that FERC
has previously worked with state regulators and groups representing
entities not subject to state regulation on a range of issues. For
example, we reported that FERC and the state commissions had already
begun initial collaboration on smart grid and demand-response
issues,\3\ and these and other entities have also collaborated on other
topics, including issues related to Regional Transmission Organizations
and electric reliability and environmental regulations.
---------------------------------------------------------------------------
\3\ GAO-11-117.
---------------------------------------------------------------------------
Question 2. I think that you are primarily talking about the NIST
smart grid standards that FERC did not adopt because they did not find
sufficient consensus in the industry to do so. Do you believe that FERC
has the authority to adopt those standards without such consensus?
Answer. Section 1305(d) of the Energy Independence and Security Act
(EISA)\4\ provides that any time after the National Institute of
Standards and Technology's (NIST) work has led to sufficient consensus
in FERC's judgment, FERC shall institute a rulemaking proceeding to
adopt such standards and protocols as may be necessary to ensure smart-
grid functionality and interoperability. In July 2011, FERC declined to
institute a rulemaking procedure to adopt initial smart grid standards
identified as a part of the NIST efforts, finding that there was not
sufficient consensus to do so. EISA does not give FERC authority to
adopt the standards in the absence of a determination by FERC that
sufficient consensus has been achieved.
---------------------------------------------------------------------------
\4\ EISA Sec. 1305(d), Pub. L. No. 110-140, Sec. 1305(d), 121
Stat. 1492, 1788 (Dec. 19, 2007).
---------------------------------------------------------------------------
As noted in our testimony statement, smart grid standards
identified through the NIST-led process outlined under EISA are
voluntary unless regulators use other authorities to indirectly compel
utilities and manufacturers to follow them. In this regard, FERC's
authority over the rates, terms, and conditions of transmission and
wholesale sales in interstate commerce and its responsibility for
reliability standards for the bulk-power system may be relevant. For
instance, to the extent that smart grid interoperability and
cybersecurity standards are deemed necessary by FERC to ensure the
reliability of the bulk power system, these standards could be
considered through reliability-based authority provided under the
Federal Power Act.\5\ Under this authority, the North American Electric
Reliability Corporation (NERC) can develop standards to protect the
reliability of the bulk power system, or be requested by FERC to do so.
If approved, such standards would be considered mandatory and
enforceable by both NERC and FERC. However, the FERC Chairman has
described limitations on FERC's reliability jurisdiction in the context
of securing smart grid systems.\6\
---------------------------------------------------------------------------
\5\ See Sec. 215 of the Federal Power Act, 16 U.S.C. Sec. 824o.
\6\ Letters from the FERC Chairman to Chairman Inouye and Ranking
Member Cochran and to Chairman Rogers and Ranking Member Dicks on
actions taken in response to GAO-11-117 (Feb. 14, 2012).
---------------------------------------------------------------------------
Responses to Questions From Senator Murkowski
Question 1. Many of the hearing witnesses noted that you simply
cannot protect an entity from all potential cyber-attacks. Mr.
Snitchler from the Ohio PUC cautions that while you can try to ``gold-
plate'' or even ``platinum-plate'' a system, the critical
infrastructure we're trying to protect will become too expensive to
run. Instead, he suggests we prioritize, using a risk-based approach.
Please comment on the issue of cybersecurity costs and the suitability
of using a risk-based approach. Do you agree with Mr. Snitchler that we
should be protecting ``diamonds like diamonds'' and ``apples like
apples''?
Answer. We have reported on the importance of using a risk-based
approach for securing critical infrastructures, including control
systems.\7\ Risk management has received widespread support within and
outside government as a tool that can help set priorities on how to
protect critical infrastructures.\8\ Security controls identified
through a risk management process should be cost-effective and reduce
risk to an acceptable level. In making decisions about risks associated
with the electricity grid, other sectors' reliance on electricity
should be an important consideration.\9\ Due to these
interdependencies, the consequences of an attack on the electricity
grid could cascade across many sectors, impacting our national economy
and security and the health and well-being of citizens.
---------------------------------------------------------------------------
\7\ See GAO, Risk Management: Further Refinements Needed to Assess
Risks and Prioritize Protective Measures at Ports and Other Critical
Infrastructure, GAO-06-91 (Washington, D.C.: Dec. 15, 2005).
\8\ Risk is the probability that a particular threat-source will
exercise (accidentally trigger or intentionally exploit) a particular
information system vulnerability. Risk management is the process of
identifying risk, assessing risk, and taking steps to reduce risk to an
acceptable level.
\9\ Federal policy established 18 critical infrastructure sectors,
including the energy sector, which has two subsectors for oil and gas
and for electricity. Other sectors include: banking and finance;
chemical; commercial facilities; communications; critical
manufacturing; dams; defense industrial base; emergency services; food
and agriculture; government facilities; health care and public health;
information technology; national monuments and icons; nuclear reactors,
materials, and waste; postal and shipping; transportation systems; and
water.
---------------------------------------------------------------------------
In relation to the need for risk-based approaches, we testified
that, in May 2012, the Department of Energy released the Electricity
Subsector Cybersecurity Risk Management Process.\10\ The guideline is
intended to ensure that cybersecurity risks for the electric grid are
addressed at the organization, mission or business process, and
information-system levels. We have not evaluated this guide.
---------------------------------------------------------------------------
\10\ U.S. Department of Energy, Electricity Subsector Cybersecurity
Risk Management Process, DOE/OE-0003 (Washington, D.C.: May 2012).
---------------------------------------------------------------------------
Question 2. We hear a lot about the potential benefits from smart
grid systems, including reduced rates and improved reliability.
However, we're starting to hear more about an unintended consequence
from smart grid systems-namely that the smart grid's reliance on IT
systems and networks exposes the electric grid to cybersecurity
vulnerabilities which could be exploited by attackers. In the 2007
energy bill, Congress directed NIST to develop smart grid
interoperability standards that FERC would later adopt. I understand
that while NIST has developed these standards, FERC has not yet taken
action because of a lack of consensus on the standards.
The 2009 stimulus bill provided over $4 billion in smart grid
funding before these NIST interoperability standards were even
developed. In fact, the stimulus bill provided $10 million in funding
for NIST to perform the standard development work. What cybersecurity
protections were included in the smart grid assets purchased with
stimulus money? Doesn't it cost more to implement security after the
network is already up and running?
Answer. We have not conducted the work necessary to answer the
question regarding what cybersecurity protections were included in the
smart grid assets purchased with stimulus money. However, with respect
to the Smart Grid Investment Grant program that received additional
funds under the American Recovery and Reinvestment Act of 2009, the
Department of Energy Inspector General found that three of the five
cybersecurity plans (required to be submitted by grantees) that it
reviewed were incomplete, and did not always sufficiently describe
security controls and how they were implemented.\11\ While this finding
cannot be projected across all such grants, it indicates a risk that
grantors and grantees were not adequately considering security prior to
the issuance of grants.
---------------------------------------------------------------------------
\11\ U.S. Department of Energy, Office of the Inspector General,
Office of Audits and Inspections, Audit Report: The Department's
Management of the Smart Grid Investment Grant Program, OAS-RA-12-04
(Washington, D.C.: January 20, 2012).
---------------------------------------------------------------------------
Generally, implementing information security features after the
technology is operating is more difficult and more costly than is
designing and developing the technology with security in mind.
Responses to Questions From Senator Barrasso
Question 1. The President's stimulus bill provided about $3.5
billion for the Smart Grid Investment Grant program. In January of this
year, the Department of Energy's Inspector General issued a report
about this program. The Inspector General stated that DOE ``approved
cyber security plans for Smart Grid projects even though some of the
plans contained shortcomings.'' The Inspector General also stated that
DOE ``was so focused on quickly disbursing [stimulus] funds that it had
not ensured [its] personnel received adequate grants management
training.'' In the Department's rush to deploy smart grid technology,
has it compromised the security of our nation's electric grid?
Answer. We have not examined the cybersecurity aspects of the smart
grid technology deployed through DOE's Smart Grid Investment Grant
program and thus cannot comment on its impact to the security of the
nation's electric grid.
Question 2. Would you please estimate how much it will cost to
secure the smart grid systems that have been deployed as a result of
stimulus funding?
Answer. We have not conducted the work necessary to answer this
question.
Question 3. Who is likely to bear the costs identified in question
2? Will it be asset-owners? Will it be ratepayers? Will it be Federal
taxpayers?
Answer. As noted above, we have not conducted the work necessary to
estimate how much it will cost to secure smart grid systems deployed as
a result of stimulus funding. As noted in previous questions, some
federal taxpayer money is being spent on smart grid systems under the
Smart Grid Investment Grant Program. However, it is unlikely that
federal taxpayers would be responsible for the costs associated with
additional activities to secure these smart grid systems unless
additional funds were designated by Congress for that purpose.
In general, however, smart grid investments-like other electricity
investments made by utilities-may be paid for in one of a number of
ways. The costs of investments in electricity systems may be passed on
to ratepayers if they are approved by the relevant regulator according
to that regulator's standards for rate recovery. In cases where an
investment is not approved by the relevant regulator, the owners of the
asset may have to bear the cost of the investment.