Cooperative Living August 2014 - 25

IT'S YOUR BUSINESS
The 'Essence' of
Cybersecurity
by Reed Karaim, Contributing Writer
T
he online world can be a dangerous
neighborhood. News of another huge
data theft or malicious computer virus
seems to arrive almost weekly. One study
found that 740 million online records were
hacked last year. Target, the giant retailer,
revealed cyber-criminals had stolen information
on as many as 70 million of its customers
alone.
While it hasn't received nearly as much publicity,
cooperatives and other electric utilities
haven't been immune from this assault. Craig
Miller, chief scientist for the National Rural
Electric Cooperative Association (NRECA), says
there are thousands of probes, big and small,
into utility systems. These threats to the security
and stability of the nation's grid are only
expected to grow.
But an ambitious effort by the Cooperative
Research Network (CRN), the research-anddevelopment
arm of NRECA, and several partners
is underway to make sure the systems
delivering your power remain safe and secure.
It's called " Essence " and through the project,
researchers are developing the next generation
of automated cybersecurity for the industry.
That's particularly important for co-op members
and other consumers, who not only count
on the power being there when they need it,
but also on their electricity provider protecting
their privacy. " The success of Essence will
improve the protections around their personal
information and it will improve the reliability of
their power systems, " says Miller.
Miller says most of the attempts to hack into
utility systems have been efforts to grab personal
data or business information. Consumers
obviously want to be sure bank account information,
social security numbers or other personal
data don't fall into the hands of identity
thieves.
But there have also been more ominous
attacks that should concern any U.S. citizen.
" There have been attempts on control systems.
They are much rarer because they require a
much higher level of expertise, and there's no
potential monetary gain, " Miller says. " But people
have done it. "
The assumption, he says, is that some of
these efforts are by " state actors, " other nations
August 2014/www.co-opliving.com
probing for potential
weaknesses. Defense
analysts also believe
a cyber-attack on the
nation's power grid
could be attractive to
terrorists for its potential
to create widespread
chaos.
The essence of Essence
is to protect Americans from
all these threats. There are
existing software programs with
the same goal, but it's how Essence
safeguards utility systems that makes it
a major advance in cybersecurity.
Most computer systems are protected
through firewalls, special software that
blocks suspicious attempts to connect or
upload software. But these programs largely
depend on lists of known threats that have to
be constantly updated. " One of the challenges
is that these security systems require expert
users who are hyper-diligent about staying current, "
says Miller. " They also have the potential
for human error. This creates vulnerabilities. "
But Essence changes the balance of power
in this constant battle. " Instead of monitoring
what's going in and out of the network, it monitors
the network itself and uses advanced algorithms
(procedures) to determine what is normal, "
explains Maurice Martin, CRN's project
manager for cybersecurity. " Essence looks for
anomalies - stuff that shouldn't be happening -
and then raises a red flag when it sees something
that's amiss. "
This means Essence doesn't have to depend
on lists of the latest dangers out there, or on
humans keeping it up-to-date. It doesn't need to
know exactly what hackers are up to because
anything that's not right with the system will get
its attention.
All this is accomplished by an unassuming
device, small enough to be held in one hand,
which can be added to a utility system in key
spots to unobtrusively monitor what's happening
on the network.
Project managers also have taken several
steps, including using storage in the cloud and
open software standards, to keep costs down
and make sure Essence doesn't require extensive
expertise to manage. " It's going to bring
state-of-the-art cybersecurity to co-ops of every
size, from the biggest to the smallest, " says
Martin. " The philosophy is no co-op left behind.
Everyone will be able to use this. "
Essence is being developed through a $4
million grant awarded by the U.S. Department
of Energy to research next-generation cybersecurity
devices. CRN has partnered with
Carnegie Mellon University, the Pacific
Northwest National Laboratory, and the cybersecurity
firm Cigital on the project. Several
large corporations are also following the effort.
Researchers hope to have the first version of
the Essence device in the field for tests early
next year. If it's as successful as expected, commercial
partners will be brought in to produce
the product, providing electric utilities with an
affordable, automated cybersecurity system
they can depend on.
That will be good news for consumers
everywhere. As Martin notes, " Maintaining
cybersecurity for your co-op or utility is
something that matters to anyone who's on a
power line. " 
Reed Karaim writes on consumer and cooperative
affairs for the National Rural Electric
Cooperative Association, the Arlington, Va.-based
service arm of the nation's 900-plus consumerowned,
not-for-profit electric cooperatives.
23
BLOSSOMSTAR/ISTOCK/THINKSTOCK
Cooperative Living August 2014

Table of Contents for the Digital Edition of Cooperative Living August 2014
