The North American Electric Reliability Corp. (NERC) participated in the Department of Homeland Security’s three-day exercise, Cyberstorm III. The exercise simulated a large-scale cyber attack on critical infrastructure across the Nation.
The goal of the exercise, which takes place every two years, is to examine and strengthen the nation’s collective cyber preparedness and response capabilities. Participants included representatives from seven Cabinet-level departments; 11 states
Prior to the exercise, NERC served on DHS’ scenario-planning development team, which began more than a year ago. The team developed nearly 2,000 scenario injections resembling elements of a cyber attack. NERC had members embedded in the control cell, the communications cell and in various other capacities for the duration of the exercise.
"NERC was pleased to participate in Cyberstorm III – both in the planning and in the execution," said Mark Weatherford, vice president and chief security officer at NERC. "Exercises like Cyber Storm III, allow the government and private sector to build better communication and identify areas where we can improve the security posture of the electricity industry."
Within NERC, the Emergency Incident Response Plan was enacted and procedures were followed throughout the exercise. The Electric Sector-Information Sharing and Analysis Center (ES-ISAC) collected data from multiple entities, evaluated the scope of impact to the bulk power system and issued alerts as needed to share information and offer recommendations to prevent widespread issues. The scenario was designed to challenge utilities at multiple locations to test backup procedures.
NERC, through the ES-ISAC, coordinated with multiple electric entities, Canadian partners and agencies, including United States Computer Emergency Readiness Team (US-CERT), and the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), as well as DHS’ National Cybersecurity and Communications Integration Center (NCIC).
NERC will review actions taken during the exercise and work with DHS to compile lessons learned from all participants.; 12 international partners; and 60 private sector companies.