Last September, news broke that hackers had laid siege to the U.S. power grid, probing deep into dozens of energy firms, looking for weaknesses to exploit. The Department of Homeland Security issued a threat warning about an ongoing stream of malware attacks that could one day lead to a Black Sky event, crippling cellphones, erasing bank accounts, devastating hospitals, and disrupting every sector of the economy. Girding our grid (some of which dates back to 1917) could cost $500 billion—too pricey for the more than 3,200 private companies that own its hardware.
To shore up defenses, the feds are funding small and nimble teams of experts to develop security and detection patches that will (hopefully) protect the system and help it recover should the Black Hats succeed. Here are some of the grid’s biggest vulnerabilities—and the efforts to fix them.
The grid’s enemies rely on expert hackers to carry out their attacks. Most of the utilities they target lack that same expertise, defending themselves with pencil-pushers rather than professionals. That’s because there aren’t enough tech-savvy hired guns to go around. To combat this vulnerability, a federal task force is setting up mutual-assistance pacts, allowing one team of cybersaviors to help multiple companies.
A hacker’s ultimate goal is to own a master control center. Within these critical hubs, system operators rely on video-covered walls and button-filled consoles to keep the grid going. If a malignant program breaks through, it could corrupt the data that controllers rely on. So some power companies are creating duplicates. These twin nerve centers trade off grid-control duties and can also access pre-hack backups, allowing workers to replace a virus-infested system with a clean version.
72 HOURS FROM ATTACK TO SOCIETY’S TOTAL DOWNFALL
When a Black Sky hits, engineers have three days before food spoils, medicine and water run out, batteries die, and the public loses its collective marbles. Speedy fixes are vital, but that’s difficult when the grid plugs thousands of power plants and even more customers into the same infrastructure. Companies like PJM Interconnection, which serves 13 eastern states, administer “organized markets” that help utilities obtain power from each other, making it easier to restore the grid.
Like your home computer, the one at your local power substation needs regular virus scans and software patches. But it, and other devices embedded in the grid, lack the capacity to keep up with these frequent fixes. Instead of constant updates, Dartmouth College researchers developed a software patch called Autoscopy Jr. It lightly scans vital functions to identify signs, such as unexpected code lengths and timing hiccups, of a compromised system.
1 IN 2 AMERICAN HOMES RELY ON SMART METERS
Utilities increasingly rely on smart meters: wireless devices that relay data about homes’ power usage to companies for monitoring and billing. But like all networked devices, smart meters are vulnerable to cyber-attacks. So BAE Systems is developing a way to keep hackers off the network. Protected with heavy encryption and multiple authentication checks, it can secure these devices while utilities shore up the rest of the grid.
At each substation, older-model computers must continuously balance a three-phase current streaming through its transmission lines. Many of these outdated machines are susceptible to malicious junk code. Rather than replacing them with pricey upgrades, a second Dartmouth project is tapping linguistics theory to write programs in which only grammatically correct input is accepted, keeping hackers from interfering with the wires.
This article was originally published in the January/February 2018 Power issue of Popular Science.
