POWER June 2012 - 37

CYBERSECURITY
Group (SGIP CSWG), led by the National
Institute of Standards and Technology
(NIST), developed the NIST Interagency
Report (NISTIR) 7628, " Guidelines for
Smart Grid Cyber Security, " September
2010. (A pdf of the report can be downloaded
from www.nist.gov/smartgrid/
index.cfm.)
NISTIR 7628 is for individuals and
utilities that will be addressing cybersecurity
for all smart grid systems in all operational
domains-generation, transmission,
and distribution. NISTIR 7628 includes
an approach for identifying cybersecurity
threats and risks and selecting and tailoring
cybersecurity requirements. Such an
approach recognizes that the electric grid
is changing from a relatively closed system
to a complex, highly interconnected
environment. Each utility's implementation
of cybersecurity requirements should
evolve as a result of changes in technology
and systems, new threats, and changes in
techniques used by adversaries. Approaches
to securing cyber technologies must be
designed and implemented early in the
transition to the smart grid. That is, cybersecurity
should be " built-in " to each smart
grid system.
The first volume of NISTIR 7628 describes
a cybersecurity strategy, including
a risk assessment process, used to identify
high-level security requirements. The volume
also presents a high-level architecture
followed by a logical reference model
used to identify and define categories of
logical interfaces within and across seven
domains. High-level security requirements
for each of the 22 logical interface categories
are then described. The first volume
concludes with a discussion of technical
cryptographic and key management issues
across the scope of smart grid systems and
devices.
The second volume is focused on privacy
issues within personal dwellings. This
volume provides awareness and discussion
of such topics as evolving smart grid
technologies and associated new types of
information related to individuals, groups
of individuals, and their behavior within
their premises. The second volume provides
recommendations, based on widely
accepted privacy principles, for entities
that participate within the smart grid.
The third volume is a compilation of
supporting analyses and references used
to develop the high-level security requirements.
These include classes of vulnerabilities
defined by the working group
and a discussion of the bottom-up security
analysis that it conducted while developing
the guidelines.
CIRCLE 19 ON READER SERVICE CARD
June 2012 | POWER
www.powermag.com
37
Research Continues
A number of research efforts related to cybersecurity
issues are taking place throughout
the industry. At the Electric Power
Research Institute, research focuses on
collaborative approaches to addressing
emerging threats to an interconnected electric
system. The initiative is also assessing
technologies for data privacy. For example,
EPRI is conducting a project to develop
standard security objects for automated metering
infrastructure (AMI) systems. This
would allow third-party vendors to develop
security applications to use and display the
alerts generated by the meters to provide
better situational awareness to AMI operators.
EPRI is also developing a " how-to " for
NISTIR 7628, to provide practical guidance
for utilities that are addressing cybersecurity
issues related to grid modernization. ■
-Annabelle Lee (alee@epri.com) is EPRI's
technical executive for cybersecurity.
http://www.nist.gov/smartgrid/ http://www.powermag.com
POWER June 2012

Table of Contents for the Digital Edition of POWER June 2012
