Cyber Security and Critical Infrastructure Protection are two important issues facing reliability in the coming years, but are fundamentally different from traditional reliability concerns. The idea that a malicious actor would somehow attempt to interfere with efforts to maintain reliability, and do so without notice, requires a far different mitigation strategy than simply improving state-estimation software or adjusting vegetation management practices.

As the electric reliability organization and home to the Electric Sector Information Sharing and Analysis Center, NERC has recently stepped up its efforts on these fronts, announcing a multi-part plan to improve its response to security concerns this July. Part of this plan included bringing me on board as NERC's new chief security officer. Other steps included the formation of an industry CEO guiding group called the Electric Sector Steering Group (ESSG), the formation of a critical infrastructure protection program area at NERC and a review of NERC's standards process in an attempt to expedite the approval of urgent security-related standards.

NERC also recommitted itself to facilitating sustained and engaged collaboration and information sharing between industry and government, which will provide the most long-term and flexible security value to both parties.

ASSESSING GRID SECURITY

One of the critical first steps to better addressing security will be to assess where we stand as an industry today, specifically, how secure is North America's electric grid?

As a first step, NERC will lead a cyber risk and preparedness evaluation of the bulk power system. The evaluation will focus on preventing intrusions, as well as the capability for isolating and limiting attacks such that the system is able to withstand subsequent equipment losses and be quickly restored. Once complete, NERC will share the metrics, recommendations and analysis developed through this evaluation to establish a starting point for future efforts.

A single evaluation of preparedness, while it provides a useful snapshot, will only show us part of the picture. We also need to know that we are addressing the right risks. To accomplish this, NERC, with the guidance of the ESSG and the assistance of its government partners, is working to establish an enhanced process, whereby it will be able to conduct comprehensive and continuous assessment of security risks to the bulk power system.

EVALUATING THREATS

Existing risk-assessment efforts tend to be focused on individual organizations and, therefore, do not provide a complete understanding of the concerns facing the interconnected bulk power system. A more comprehensive look will enable us to identify areas of concern, prioritize them on an industry-wide basis and develop prudent approaches to addressing material threats. This process of evaluating threats will help to guide protection goals and strategies, including the development of future reliability standards, by identifying trends and benchmarking progress.

Perhaps one of the most important benefits of these assessments will be to create a common language through which industry and government will be able to privately and effectively highlight both existing and emerging concerns. NERC will work with industry to codify that common language, so that measures, alerts and standards development efforts can begin with a shared understanding of any given security threat's true significance: How large and how long of a disturbance could result? How often could such a disturbance recur? What is the impact to reliability in the short term and the long term?

I believe this categorization process will add a necessary discipline that will ensure a common understanding of the significance of threats and provide the needed context to mobilize industry response.

All of these efforts, however, require industry support and engagement to be successful. After all, only those who own and operate the assets are able to protect them on a continuous basis. I firmly believe that it is NERC's job to help the industry do just that.

Michael Assante is NERC's chief security officer. Formerly the chief security officer at American Electric Power and strategist for the Department of Energy's Idaho National Labs, Assante is a renowned expert in cyber and physical security of the electric grid. michael.assante@nerc.net