IEEE Power & Energy Magazine - September/October 2016 - 54

Security
Management
Controls CIP-003

Critical Cyberassets
CIP-002
* Low, Medium, High
Criteria
* 15-Month Review

* Cyber Policy for
Low/Medium/High
* Leadership
* Document Delegates

Systems Security
Management
CIP-007
* Ports and Services
* Security Patch
* Malicious Code
Prevention
* Event Monitoring
* Access Controls

Incident Reporting
and Response
Planning CIP-008
* Cyberincident
Response Plan
* Implementation
and Testing of
Response Plans
* Response Plan
Review

Personnel and
Training
CIP-004
* Awareness
* Training
* Risk Assessment
* Access Program

Electronic Security
Perimeters
CIP-005

Physical Security
CIP-006

* Electronic Security
Parameter
* Remote Access
Management

* Plan
* Visitor Control Plan
* Maintenance and
Testing

Recovery Plans for
BES Cyber Systems
CIP-009

Configuration Change
and Vulnerability
Assessment CIP-010

Information
Protection
CIP-011

* Recovery Plans
* Plan Implementation
and Testing
* Plan Review,
Update, and
Communications

* Configuration
Change
Management
Process
* Monitor and Control
* Vulnerability
Assessment

* Information
Protection Process
* Bulk Electric
System
Cyberasset
Reuse and
Disposal

figure 2. Current NERC CIP standards as of March 2016.

as BlackEnergy be removed. The Aurora vulnerability has
been proven as a risk for any electric substation without the
proper protection hardware. Most facilities still do not have
the safeguard installed, yet the NERC CIP standards do not
require this mitigation. While compliance to the CIP standards is a move in the right direction, there is certainly more
that utilities can, and should, be doing to protect themselves,
their assets, personnel, customers, and the environment.
The president and CEO of a large U.S. electric utility
recently called on the private sector to "play offense" when
it comes to federal policies and regulations on cybersecurity and acknowledged that a recent cyberattack resulting
in widespread power outages has put utilities around the
globe on edge. When asked for his view on the overall grid
resiliency though, this utility leader responded, "Is the U.S.
grid 100% insulated from threats? Absolutely not." Then he
concluded, "But are we safe? Yeah." Complacency and mere
compliance to standards are not sufficient. Vigilance with
a stronger commitment to practical cyberprotection of ICSs
should be initiatives sponsored by utility industry leadership.
Robert M. Lee, a former cyber warfare operations officer for
the U.S. Air Force has a more sobering viewpoint. When
asked about the U.S. power systems' vulnerability after the
Ukrainian attack he said, "Despite what's been said by officials in the media, every bit of this is doable in the U.S. grid."
Perhaps the risk impact is simply too unthinkable, too
expansive, and too expensive to contemplate. Leading cybersecurity insurance underwriters are certainly struggling
with this. Some have severely restricted market capacity
of business interruption insurance (coverage for lost profits
from operational downtime) precisely because they lack the
confidence that utilities are doing enough to address cyber
risk associated with their ICSs and because models are nonexistent to accurately describe the extent of lost profits. Even
with respect to conventional cybersecurity coverage, leading
54

ieee power & energy magazine

insurers have become adept at hiring information security
experts to thoroughly assess for themselves an insured's
cybersecurity risk posture (based on global standards and
frameworks such as NIST-800 and ISO 27001:2013), before
even considering extending coverage.
But neither of these standards was developed with an
understanding of the unique ICS cyberissues and challenges,
and that presents the industry with a problem. Insurance overage for physical damage, injury, and environmental consequences are some of the least common offered, showing that
cyberthreats to operational technology (OT), the controls systems for physical processes, are not as well recognized and
in demand as IT threats. This concerns the insurance industry because a number of cyberattacks have been reported on
utility companies. Some power companies reported that they
experience thousands of attempted cyberattacks every month,
with some being associated with ransom demands.

What Can Be Done Now?
An important first step is to have the organization, from senior
management through operations and IT, understand ICS cybersecurity issues and perform a thorough evaluation and assessment of their current threat and vulnerability environment.
The next step is to establish a cross-functional/cross-discipline
team representing operations, maintenance, engineering, IT,
forensics, telecom, risk management, and public relations to
correlate and address ICS cybersecurity in context of the organization's mission. There also needs to be adequate resources
and reporting to the C-level and the board, two proven accelerators of maturity in cyberstature. A "living" ICS cybersecurity
program should be established that develops and employs ICS
cybersecurity policies and metrics. To know what to protect,
utilities need to know what at-risk assets they have deployed
enterprise-wide, including all equipment located in the field.
Consequently, a thorough review of all installed systems,
september/october 2016

Table of Contents for the Digital Edition of IEEE Power & Energy Magazine - September/October 2016