Comment On Article About The Author More Articles By This Author

The push for greener, more efficient energy distribution is driving the rapid development and deployment of Advanced Metering Infrastructure (AMI) technology, or smart meters. Smart meters are considered to be just one technology platform within an overall suite of maturing smart grid energy management technologies. These technologies will foster the modernization of the nation's electrical power infrastructure into what will ultimately become the cornerstone for the power grid of tomorrow. In conjunction with the approved $4.5 billion economic stimulus package, the need to create U.S. jobs and a rapidly evolving market space, this long-awaited advancement to the U.S. power infrastructure has become a reality today. But is the technology ready?

This new generation of energy distribution technology promises to deliver real-time information, and enable the near-instantaneous balance of supply and demand. Utilities and consumers alike will benefit from the smart grid's ability to sense system overloads and reroute power to prevent, or minimize, potential outages. Yet, as with any new innovation promising such benefits, there is both opportunity and associated risk. Without considering the risks, we may never truly see the benefits.

In April, IOActive researchers were able to identify multiple programming errors on a series of smart meter platforms ranging from the inappropriate use of banned functions to protocol implementation issues. The research team was able to "weaponize" these attack vectors, and create an in-flash rootkit, which allowed them to assume full system control of all exposed smart meter capabilities, including remote power on, power off, usage reporting, and communication configurations. The initial attack vector could also be leveraged to deploy a worm, much like the Blaster worm that wreaked havoc on computer systems in 2003. The consequences of such threats are potentially widespread and devastating.

And hardware attacks are on the rise, due in large part to the relative ease with which they can be launched. While most software developers build base-level security into their products, hardware level has long been overlooked. Simply acquire a smart meter, and it is easy enough to reverse-engineer the device due to the lack of encryption at the hardware level. Or decode the device's communications by listening to the spectrum of radio patterns emitted by the smart meter. Neither method requires an overspecialized background or significant financial investment. Consider that most utility meters sit outside private residences and businesses, with little or no physical security to prevent access, and you have a recipe for tampering.

Think this scenario is unlikely? Unfortunately, it's far more likely than people care to imagine. A Department of Energy lab recently published a statistic showing that there were roughly 250 exploits for control systems on any given day in 2006-2007. It was reported to take roughly 131 days to patch and remediate those vulnerabilities -- leaving the window open for exploitation.

Beyond the ease of threat, the reality is that utility companies are viewed as recession-proof, and thus always earning money. This makes them an attractive target for criminals. Vulnerabilities in the smart grid could cause utilities to lose system control of their metering infrastructure to unauthorized third parties, exposing them to fraud, extortion attempts, lawsuits, widespread system interruption, massive blackouts or worse. The severity of the situation is driving the release of the Critical Electric Infrastructure Protection Act (CEIPA), a new bill solely focused on addressing cybersecurity concerns of the U.S. power grid. And it's only just beginning.

All of this indicates that the security maturity of the smart meter market warrants immediate inquiry and evaluation. With more than two million smart meters in field use today, and an additional 17 million devices on order by over 73 participating utilities, the threat is not a localized concern. Furthermore, smart meter technology is expected to last 10 to 20 years in the field.

So can the smart grid be saved? While there are clearly challenges ahead, it's not too late. The utility sector can, and should, protect their investment by demanding that smart meter devices come equipped with the types of security protection afforded to computers on a standard enterprise network.

The challenge to building a secure smart grid power infrastructure is to quickly enact methods that support both asset owners and smart grid vendors. Typical of most emerging industries and first-to-market initiatives, the smart grid AMI community lacks a formal Secure Development Lifecycle (SDL) to guide and govern the release of sound quality technology and products. Including a requirement to conduct independent third-party security assessments of all smart grid technology will further enable the smart grid AMI industry to deploy their technology in a secure, mindful fashion without causing significant time-to-market delays.

The SDL is a proven tool for saving money, and decreasing exposure to risk. Studies show that overall project costs are 60 times higher when gaps in information security controls are addressed late in the development cycle, as opposed to projects where security is implemented in the design phase. Championed by Microsoft, the SDL contributed to a massive reduction in the number of security bulletins issued for Windows Server 2003 and SQL Server 2000.

In light of where we are with the application of smart grid technology, there is still time to stop. Private industry is ready and well positioned to take on this challenge to help pave the way towards a secure smart grid infrastructure that will benefit generations to come. Already at the forefront of the research efforts around AMI security, the industry has been intimately involved in the development and refinement of the SDL.

And as the old saying goes, "measure twice, cut once." Utilities should embrace their role as the stewards of the energy "ecosystem," and hold smart meter vendors accountable for the security of their products. By demanding that their suppliers adopt secure development practices, and requiring them to undergo third-party security auditing, energy utilities can thrive from the benefit of the smart grid while insuring the future safety of the nation's critical infrastructure.