Confusion threatens NIST smart grid security progress

Quick Take: The quasi-watchdog Government Accountability Office (GAO) has taken a hard look at the progress on smart grid standards and it doesn't like what it sees. To be more accurate, it likes what NIST has done, but says it needs to do even more, especially around issues of combined cyber and physical attacks.   But the real mess is over enforcement. In its typical half-assed fashion, Congress gave FERC the authority to set standards, but not to enforce them. Last I checked, "Pretty please with jam on top" is not a very effective way to get compliance, especially when asking organizations to spend many millions of dollars. Up next: a mad scramble to find loopholes or workarounds. – Jesse Berst

1

The smart grid's growing pains got, well, a little more painful after the Government Accountability Office (GAO) took the National Institute of Standards and Technology (NIST) and the Federal Energy Regulatory Commission (FERC) to the woodshed for shortcomings in the smart grid security standards  and guidelines development effort.

A GAO report on the current status of standards and guidelines development also pointed out one glaring problem FERC can't do much about: The agency can adopt standards but can't enforce them. The report notes "While EISA (the Energy Independence and Security Act of 2007) gives FERC authority to adopt smart grid standards, it does not provide FERC with specific enforcement authority." A bit like saying "Here's a brand new Tesla, but we're not giving you the keys." In an interview with Smart Grid News in November, FERC Chairman Jon Wellinghoff acknowledged as much with the comment "If there's an imminent threat right now, we (FERC) don't have sufficient authority to address it."

The GAO report did credit NIST for the work it has already done, but pointed out that missing elements – such as addressing securing smart grid systems against both cyber and physical attacks – have yet to be included in updated guidelines. NIST has pledged to do so, but those guidelines are now in draft form. "Until the missing elements are addressed, there is an increased risk that smart grid implementations will not be as secure as otherwise possible," the report said.

More on this topic ...

Smart grid security standards in hurry-up-and-wait mode as 2010 winds down

Smart grid standards: Interoperability and cyber security standards ready for review