Cyber security is of the utmost importance to a sustainable modern grid. The smart grid involves the automation of several manual processes and procedures. It does so, in part, by overlaying a communications infrastructure on top of the grid, allowing utilities to make better decisions about energy usage and spot potential failures more quickly.

For its part, cyber security helps to augment reliability where automated solutions and advanced processes break down. This reliability is critical to every utility and may be the most important facet of energy operations, because unreliability results in utilities' inability to provide power. Consumers may not notice the automation of the grid, but they will notice if the lights go out.

Unfortunately, in most cases today, security standards and regulations fall short of what is needed to provide maximum assurance of smart grid reliability from a cyber security perspective.

Security Standards

Currently, cyber security regulations are being applied to some elements of the transmission system but not all elements of the smart grid. Critical infrastructure protection (CIP) denotes whether or not an energy management or supply system should be bound to government oversight, and several government agencies have begun developing CIP security standards. The Federal Energy Regulatory Commission (FERC) directed the North American Electric Reliability Corporation (NERC) to mandate standards for some of the smart grid systems, but the National Institute for Standards and Technology (NIST) is developing additional standards that will be applied to assets that make up the smart grid that currently fall under the guise of CIP.

Unfortunately, as the result of an overly narrow definition and interpretation of what is critical, much of what is normally considered a critical infrastructure system has yet to be identified and thus subjected to FERC's mandates. Although cyber security standards are important to securing the modern grid through enhancement of its reliability, they are currently only being applied in specific cases that augment reliability on the national level but not on the local level.

Threats to AMI

Advanced metering infrastructure (AMI) is the primary system used to support utility consumers, both households and businesses. The system is advanced because, for the first time in history, utilities have the ability to aggregate information and control metering systems at the same time.

By aggregating data from meters, utilities can automate billing and problems with meters from a centralized interface. The addition of the control element also allows utilities to perform energy control functions from a central computer console. For example, utilities could remotely disconnect non-paying consumers and realize a cost savings from not having to roll a truck to a residence to disconnect or reconnect service manually.

Moreover, having access to near-real-time usage information allows utilities to adjust generation based on voltage levels at end points and better gauge the effectiveness of programs designed to reduce energy usage. Thinking of this in the context of hundreds of thousands of consumers, the savings in labor hours are obvious. This process constitutes typical leveraging of information technology (IT) to realize the benefits of centralized command and control. The use of IT to augment functionality also presents cyber risks because of the nature of the required infrastructure.

AMI is comprised of a combination of mechanical IT assets that serve to perform the instrumentation. Meters, although digital, must maintain a switch that can be activated by a computer in order to break the connection because energy is always flowing, and the only way to stop it is to trigger a switch that breaks the connection. This is similar to how a circuit breaker in the common household works. If the disconnect switch on the breaker is flipped, then power is shut off to a house.