When do you buy a burglar alarm for the smart energy grid? Read More Oct 19, 2020
NES Implementation of OSGP Read More Oct 07, 2020
Energy Theft and Fraud Reduction Read More Jun 17, 2020
Smart Grid Security and Defensive Military Architecture of the Middle- ages; an Interesting Comparison Read More Feb 12, 2020
Survey Results - Feeding the Big Data & Artificial Intelligence “Information-Appetite” – From the Low-Voltage Grid Read More Oct 03, 2019
NES VP Customer Solutions, Jon Wells, interviewed by OSGP: What will NES bring to EUW 2019? Read More Oct 01, 2019
Getting ready to operate the smarter grid: How Smart Grid Operations, aligned to ITIL, can enable the Smart Energy Transition Read More Sep 25, 2019
Smart Meters Need More Protection from Hackers Read More Aug 05, 2019

In an earlier white-paper, we questioned how to feed information into the ever-hungry maws of the big data and AI platforms, especially focusing on the information coming from the low-voltage grid.

The Question, Re-phased and Summarised
As the Smart Energy Transition picks up pace, the role of the smart grid is coming more into focus. A major driver are the initiatives of Electric Vehicle introduction, distributed and green energy production and storage, and energy community projects and micro-grid. These will have profound effects on the low-voltage grid, as this is where many of these initiatives are being delivered.
 Historically, it has been a major challenge to provide cost effective monitoring, management and control into the low-voltage grid. The result we have now, is a low-voltage grid which is essentially passive in nature with manageability limited to the “edges” of a black box and limited means to see and then control what happens within that black-box.
 

The Answer
The earlier White-paper described a series of “false dawns” where individual technology solutions presented possible solutions; big data and AI itself, IoT to gather information and connect devices, and then the smart meter. These solutions do not work in isolation, and it is only by integrating them into wider systems that it becomes possible to shine a spot-light on the low-voltage grid, and now it supports the Smart Energy Transition. In summary, the need is to have the measurement points in the low-voltage grid, enrich the information close to the source, connect multiple communications 
paths to the devices so that the strengths of multiple technologies can be combined and apply robust security to protect privileged information at source and in transit.
This then starts to drive the decision around investment in the low-voltage grid, especially in smart meters. The question for the procurement strategy for utilities is essentially: “With the major investments in big data and AI solutions, does it not make sense to focus investments on the sources of the information and the means of getting it? Isn’t the alternative simply wasting the opportunity to leverage the investment in the big data and AI platforms, and so have them become starved of information they need to justify their position?”.
 

A Survey
The results of a short survey conducted by NES, in conjunction with Smart Energy International, goes a long way to confirming some of these positions, and indicates where the utilities industry sits on this important issue. This survey was conducted in the course of a webinar addressing these specific issues which was attended by a blend of utilities, consultants, regulators and technology providers.

Around 75% of the respondents have investments either on-going or planned for big data and analytics for the low-voltage grid. This confirms the overall investment profile and the perception that it is important to gain more insight into this important part of the network.

An interesting dip in the next 12 months is an indicator of projects in wait status, possibly for external drives, such as regulation and technology capabilities, to establish themselves more clearly over late 2019 and 2020.

What is interesting here is the perception that the information is fundamentally not readily availability. This is clearly a reflection that unless supported by deployments of sophisticated smart meters and using these as sensors in the low-voltage grid, there is little available information. It also indicates that visibility within the black-box of the low-voltage grid is lacking. It may be possible to put some levels of manageability around the edges, but what happens inside is still unknown.

The second outcome was the reliability of getting to the information. This has been a major problem historically – whilst communications infrastructure exists, it is often not tuned to the specific demands of a smart meter deployment, and so reachability can be a challenge. This leads to the need for improved tooling for managing the communications outcomes – not communications network management but tooling to monitor SLAs on the business transactions of gathering information, and then using these to drive improvement plans. Related to this is the overall deployment of O&M tooling to keep the smart devices in the grid functioning properly.

Once availability and reliability improve, it is probable that the next bottle-neck will become throughout. The information will be there, and the challenge becomes how to get to it.

This next question focused more on the balance between procurement policies aiming to maximise margin by reducing cost and the need to invest in infrastructure. In the case of this survey, the underlying point is does the investment in the big data and AI solutions balance the investment in the equally important sensors and communications infrastructure in the low-voltage grid.

Currently, there seems to be a balance between future-looking functional requirements and the need to control costs. Interestingly, there is a very slight bias towards the future-looking functional requirements, which may indicate that procurement departments are starting to become aware of the need to invest in the low-voltage grid in order to leverage the investment in the big data and AI platforms.

The focus of this question was not just IT security generally, but specifically related to the increased deployment of advanced devices in the field, which, themselves, open up the opportunities for cyber-attack, directly as a result of their sophistication.

Unsurprisingly, people are generally very concerned. As more information is gathered from the low-voltage grid to feed big data and AI, there is more opportunity to capture that information, falsify it or simply block the flow. Whilst this is deemed to be simply operational data, the scope of impacts are limited to the utilities operational efficiency, but as more information comes from the smart meters, there is more of a perception that this is personal information. This brings GDPR (and similar legislation beyond Europe) into the equation.

What is interesting is that there are people who are only Moderately or Slightly Concerned; possibly driven by (1) the lack of publicised attacks, (2) the hope that it will happen to someone else and (3) technology will provide an answer in time.

 

NES Perspective on the Survey
NES provide smart grid devices and complementary operations, analytics and security software solutions.
Consequently, such results relate strongly to NES capabilities:

Devices
NES provides high-quality smart grid devices for the low-voltage grid which provide sensors, multiple communications options and protection of the valuable information. Investment in high-quality smart meters is the cornerstone of gathering information from the low-voltage grid.
All NES devices are built to these underpinning principles.

Analytics Software
NES provides enrichment of the sensor information by discovering the topology of the low-voltage grid, and then assessing phase balancing and energy flows within this grid. As well as providing for operational improvements and outage impact detection, this provides more of the information required to perform capacity and loading analysis in readiness for EVs, distributed generation, fraud/theft and community energy. This is the information required from the low-voltage grid to drive the Smart Energy Transition forwards. NES Grid Navigator and Grid Flow provide these functions.
 

Operations and Communications Monitoring Software
Operational efficiency and monitoring communications SLAs are a key aspect of maximising the information which can be gathered from the low-voltage grid by identifying areas of poor performance, and then using this to assess root-causes and resolve them. As well as the assuring the communications, robust O&M activities, supporting by tooling, ensure that the availability of the devices is maximised together with the communications. Finally, reception of events and alarms can also indicate problems in the low-voltage grid – the meter sees the symptoms of wider problems.
NES Grid Operations solutions implement both these key functions.
 

Security Software
The smart grid industry has focused on maintaining an IT security perimeter. Most ICT strategies now recognise that the perimeter will be breached, and protection in depth is required. This is achieved through intrusion detection and response systems.
NES Grid Watch provides intrusion detection and response solutions specifically for the devices now being deployed into the low-voltage Smart Grid.

Summary
A very interesting survey and thanks to all the contributed.
Overall, the results indicate that there is a significant on-going investment in big data and AI, specifically as it relates to the low-voltage grid. There is at least a balance between procurement policies of back-end analytics and sensors in the low-voltage grid compared to cost control, meaning that utilities recognise the dependency between the two areas of investment. Using the meters as a sensor is clearly a major opportunity, but more can be done to expose what is actually happening in the low-voltage grid black-box. Finally, getting all this information and keeping it secure is a major concern.
NES Smart Grid solutions are well placed to assist utilities as they move through the Smart Energy Transition and use Big Data and AI as a means to drive their business and technology decisions.

1. What do you see as the biggest smart grid industry challenge and how does NES contribute to the solutions?
 
In the last 12 months, since last EUW, we have seen the clear emergence of the Smart Energy Transition on the agenda. This is centred on using technology to address issues such as incorporation of locally generated cleaner energy into the grid, consumer enablement, reduction of transmission losses, automation, demand control and peak management, micro-grid and security.
 
Whilst conceptually simple, the technological and organisational transition is massive. No where more so than in the low-voltage grid; where visibility and manageability have been hardest to achieve, despite this being where the greatest change will be experienced. The key to success is to deploy sophisticated infrastructure which “future-proofs” the low-voltage grid by embedding intelligence which can be leveraged incrementally as the business case for change evolves and becomes self-sustaining.
 
NES smart grid solutions encompass both the metering infrastructure, analytics, operational and security solutions, and consulting and services to deploy sophisticated solutions in readiness for the Smart Energy Transition. 
 
2. Could you provide some background information on the current utility projects NES is involved in and what NES’ contribution is to the projects?
 
NES has undertaken several leading-edge projects this year which have helped several DSOs drive towards the Smart Energy Transition:
- Danish utility Ravdex, have used a multi-communications paths, enabled by the NES meter, to provide low-latency transmission of power quality information from the meter to an analytics back-end
- Linz Strom, are developing leading security solutions to ensure that their smart grid in Austria remains protected from cyber attack as its sophistication, and thus attractiveness as a target, increases
- OSHEE, Albanian DSO, are deploying NES analytics and operational software solutions to provide increased visibility of “black-box” low-voltage grid, to maintain high visibility of the meters and keep the infrastructure operating efficiently
- In Poland, Tauron are continuing to deploy NES meters, bringing the total number of meters under operational management by NES software up to over 1M.
 
This is in addition to our on-going European projects with major DSOs such as EON (Sweden), Vattenfall (Sweden), Caruna (Finland), Konstant (Denmark) and Cerius (Denmark), numerous DSOs in Switzerland, France, Germany, Poland, Romania and Ukraine.
 
3. What is your view related to the Open Smart Grid Protocol (OSGP) to promote and advance the capabilities of innovative solutions for utilities?
 
As well as providing a foundation for highly reliable and secure communications, the OSGP Alliance also offers NES access to a valued ecosystem of complementary and compatible product vendors. Many of NES products require that compatibility, especially when our customers require integration to back-end systems (many of which are OSGP members) and require a multi-vendor smart meter infrastructure supply.
 
In fact, the OSGP is offering many exciting opportunities for NES software solutions – our operations and security solutions are compatible with any 3rd party OSGP compliant meter – taking inter-operability beyond the meter and straight standards compliance.
 
4. What will NES be showcasing at the EUW2019 - OSGP Alliance Pavilion and how does this contribute to the Energy transition?
 
NES has been consolidating the functionality of its smart meter foundation, proving new communications approaches, developing solutions for demand control and peak management and implementing new security capabilities to maintain NES as the leading security provider for smart meters.
 
NES is now bringing exciting new software solutions to market and refreshing tried and tested capabilities in readiness for the Smart Energy Transition:
- Operations – with over 1M OSGP meters under operations management, NES’s release of Grid Operations reinforces our focus on helping our customers make the most of their investment and harnessing the flexibility of the smart meters through one-screen operations views
- Visibility and Analytics – NES Grid AI solution provides new levels of visibility in the low-voltage grid, allowing points of imbalance, over-utilisation and spare capacity to be quickly identified, in readiness for the Smart Energy Transition
- Security – NES Grid Watch provides DSOs with intrusion detection and response capabilities which go way beyond the traditional perimeter protection solutions offered by other meter vendors and standards
 
5. Who should be visiting the stand and why?
 
Members of any DSO with a focus on smart grid and low-voltage grid should be interested in what NES has to offer. This year, the focus is on the Smart Energy Transition, and any DSO looking at their readiness for this transition should review how NES solutions can help them achieve this. The objective is not to achieve the transition in one “big bang”, but, instead, deploy sophisticated technology solutions which will allow a gradual transition where each step is based on a robust business case and outcome. This is the way that the Smart Energy Transition will be executed, and NES provides just the right solutions to enable this transition.
In the past, the grid was not smart
Equipment was either unmanaged or managed through highly bespoke, isolated and dedicated systems.
Equipment was only able to perform the task it was deployed to do and required a manual intervention to change configuration to perform a different task (or the same task with different parameters). There was very little opportunity to change the way equipment functioned remotely and dynamically.
Equipment was largely unable to notify monitoring teams about potential and actual performance degradations or critical alerts.
Equipment was developed for a simple distribution model – energy was created centrally and then distributed out towards the consumer – always and forever.
In a sense, the grid was “hard-coded” to a specification and was largely mute in terms of how it performed against that specification. Furthermore, that specification is now no longer fit for purpose, when viewed against the changes about to hit the grid.
 
In the past, did we care about operational efficiency?
When we stand back and think about operations of grid a decade ago, can we honestly say that we were aware of operational efficiency? Sure, there was a known cost for maintaining an operations capability (staff, equipment, facilities etc….), but did we really track how operational efficiency was impacting the business?
Perhaps, the limitation was that there was little capability to manage the grid in a dynamic manner, and so the impacts of high MTTR, low MTBF, high MTTP and long time-to-market were not tracked in terms of their business impact – the operational processes were simply focused on fixing the problems when they appeared and trying to proactively maintain selected high-value and high-impact assets.
This one-dimensional view was adequate in a simple model of centralised generation to remote consumers but does not reflect the increasingly complex and dynamic “supply-chain” involved in energy generation and consumption as we go through the smart energy transition.
This situation was especially pronounced in the low-voltage grid, where assets are generally of relatively low financial value (not worth managing), almost entirely manually managed and expected to perform the same role (and the same configuration) from deployment through to end-of-life.
 
Change has to happen
This is unfortunate because it is in the low-voltage grid that the energy transition, driven by the Clean Energy Package and other green energy and conservations initiatives, is going have the largest impact over the next decades:
• Increased distributed generation and storage – using residential scale equipment to generate solar, wind and hydro energy, store locally, and feed back into the local low-voltage grid
• Community energy and micro-grid – balancing the supply of energy within a community to minimise the demand on external centrally generated energy.
Both require a low-voltage grid that is highly optimised, and which can be dynamically switched through modes of operation to maintain that optimisation as demand and generation changes.
 
The thing which is making the grid smarter is software
Software allows Smart Grid equipment to be both multi-function (or at least highly configurable) and remotely manageable. (Lets stop saying equipment because that implies hardware.) This is what is allowing the Smart Grid to transition from a traditional static centralised model for energy generation and distribution to a dynamic, bi-directional, de-centralised model for energy generation, storage and brokering towards the edge and closer to the consumer.
Simply put, through software and its configuration, components (not equipment) of the Smart Grid have functions which adapt over time to the local energy flows and wider contextual demand, consumption and trends.
As we move towards the Smart Grid, we need to review the value of the traditional approaches of managing the grid – initially field-engineers and with cumbersome, isolated and bespoke management solutions for high- and medium- voltage grid. Especially, we need to review the low-voltage grid, where remote management and automation has been absent for all its history. We need to recognise that increasingly, the physical platforms (including the sophisticated IT compute resource build into these platforms) are less relevant and it is the software (and included in that, the firmware) and the configuration of that software which needs to be managed.
 
A new type of issue – the Configuration Error
With this change, the types of issue that must be managed also change. Faults and performance issues will still exist with platforms and communications infrastructure. But, as the configuration of software becomes more important and complex, operational problems related to errors in that configuration will become more of an issue and will have the potential to cause as much service impact as mechanical failures of the pre-smart grid. In fact, in IT and telecommunications network deployment, it is often a poorly planned release of new configuration which causes problems – the configuration and the action of configurating is a source of error.
 
A new type of issue – the Cyber Attack
Traditional grid equipment only needs to be protected from a physical attack. As software starts to dominate the capabilities of the Smart Grid, the opportunities for cyber criminals to attack the grid increase dramatically. Attacks can now be made against the software itself, its configuration and its operation. Operational teams will start to receive indicators of suspicious activity, attacks and successful penetrations, but will traditional styles of grid operations provide the knowledge and responsiveness to cope? Will they even recognise the threat and the attack?
 
A new type of issue – Introducing Change
Change in Smart Grid capabilities will be introduced through releasing new versions of software (or firmware) and new versions of configuration. Introducing change to many 100Ks of meters in a structured way is essential to ensure continued operation through the transition and after completion of the change. Any failures of that change will introduce weaknesses, inconsistencies and vulnerabilities in the infrastructure. The approaches, skills, processes and monitoring tools to achieve release management are very different to those required for a traditional grid.
 
A new type of issue – Monitoring Business KPIs and SLAs
As the grid becomes Smart, its ability to play a role in the overall business performance increases. The operational processes can be linked to business-level KPIs such as customer experience, operational expense, capital expense, revenue leakage, market reputation etc….. Furthermore, operational performance impacts regulatory requirements, such as SAIFI and SAIDI. The traditional grid operational practices need to feed into these KPIs. Operational teams may even become accountable within the business for achieving SLAs. Smart Grid operations processes and tooling need to allow for this business perspective, and tune activities to optimise KPI scores and SLA compliance.
 
This all sounds familiar to IT management specialists
There is a natural convergence between the Smart Grid and the world of IT. Lets draw some parallels:
 
 

This has happened before

Other industries have gone through a similar transition.
Only 30 years ago, the telecoms network looked just like the traditional pre-smart-grid with technology in the centre and passive “dumb” equipment in the field and the consumer premise.
All that changed with the introduction of Digital Subscriber Line (DSL) and then (a few years later) with the smart-phone – suddenly, the sophistication of equipment in the field and the consumer’s premise (and the consumer’s hand) increased dramatically and started to look more like IT resources than telecoms equipment.
Today, a typical telecoms service provides a DSL (or cable or satellite) modem, a router, a smart phone, often together with broadcast and on-demand TV, in-built value-added services delivered to these end-points, connections to highly sophisticated equipment in the exchange/head-end/base-station, and a number of back-end services hosted by IT infrastructure either at the exchange/head-end/base-station or potentially anywhere, including the cloud. Communications are bi-directional and services can be provided by IT close to what was traditionally the edge of the network. Whilst dedicated telecommunications equipment remains, it is largely software enabled, and most of the high-value services are provided by software solutions.
Processes for the operational management of this technology needed to change to support these new types of resource and service delivery supply-chains. The result, being implemented today, is a set of standards derived from a convergence of TMF eTOM (processes dedicated to the management of telecoms infrastructures) and ITIL (the IT Information Library) which is a process set for the operations of IT infrastructure. It is this practical blending of telecommunications requirements with IT requirements which has let to this successful outcome.

OT and IT Convergence
This change in the telecoms industry is not isolated.
There is a wider trend of convergence amongst Operational Technology (the tools and systems which execute an organisations operations) and Information Technology. The drivers are very similar – initially, operational assets were not very intelligent or “open” in terms of their manageability, and so proprietary tooling was required to manage them, often labelled SCADA. As infrastructure embeds more IT-like characteristics and starts to follow more “open” management, communications and security protocols, there is a natural convergence.
Consider a fleet of trucks as an operational asset of a haulier. A decade ago, these were counted in and out at the depot with a mileage and tachometer check at the end of each day. Now, the truck has GPS, real-time telemetry, and all sorts of driver aids; all driven by software, configuration, reference data (e.g. digital maps and traffic information) which is automatically updated. And the materials in the truck all have RFID so they can be logged into an asset management system via scanning. 
And that is just trucks and haulage – imagine the convergence possibilities for a technology area which is actively trying to be smarter.

Applying IT management concepts to the Smart Grid
ITIL can benefit the Smart Grid, when used in conjunction with specific Smart Grid aligned operational processes.

 

It is grouped into five main process areas – Strategy, Design, Transition, Operation and Continual Improvement. Although developed for the IT industry, it is easy to see how these can become relevant to the Smart Grid as it evolves to contain more and more IT resources.

Not all elements of ITIL are directly or immediately relevant to a DSO’s Smart Grid operations, and all should be blended with those operational processes which are specific to the Smart Grid.

But, that is OK. ITIL is designed so that it can be applied gradually to an organisation, with a focus on those specific outcomes the organisation wishes to achieve. For a DSO operations team, the focus would be on Design, Transition and Operation, with Strategy and Continual Improvement being part of the surrounding organisational context for the DSO operations team.

So, as the focus on business and regulatory KPIs for the ops team increases and more IT is deployed towards the edge and towards the consumer, the following ITIL elements will become important, blended into the Smart Grid operational processes and driven by distinct business outcomes.

 

Keeping the Smart Grid specifics; recognising the differences
Keeping those operational processes which are specific to the Smart Grid is important. In telecoms, the outcome was a blend of two standards eTOM, from the TMF, and ITIL. So should the same approach be provided for Smart Grids.
This is particularly important in security; the Smart Grid has specific threats, vulnerabilities and temptations to the cyber-criminal which are unique to it. Whilst IT security practices can form a template, they do not provide directly applicable solutions. This is one area where the Smart Grid operations teams need to consider carefully – who will attack me, what is their motivation, what parts of the infrastructure will they attack, how will I identify the threat, how will I recognise an attack, how will I know it is successful, how will I respond to it. Answers to these questions can’t be lifted from an IT manual and applied to Smart Grid operations – they are unique to Smart Grid.

Making practical use of this
Right now, Smart Grids are being deployed, and the focus is on rollout and business case realisation. But, soon, the operational efficiency will become more significant, as it becomes more widely recognised that this is an influencer on many of the business and regulatory KPIs upon which the business case is based – specifically, customer experience, reputation, op-ex, cap-ex, revenue leakage reduction and security. The increasingly dynamic nature of the smart grid will need to be managed to meet the demands of the smart energy transition.
Like in the telecoms example, the operational requirements associated directly with a Smart Grid will be combined with a more general appreciation of operating an IT infrastructure, especially in the area of security. At this stage, a new class of operational tools will be required which implement ITIL aligned processes in conjunction with the specific process and technology requirements of the Smart Grid.
Such tools are in development today, in readiness for the point when the IT in the Smart Grid dominates over the physical infrastructure.

A real solution
Networked Energy Services (NES) is a leading developer of smart grid technology. It is investing in a new suite of solutions which are already blending key ITIL concepts with Smart Grid operations to ensure that the Smart Grid can be efficiently operated as the increased embedded IT makes it Smarter. Furthermore, its suite includes new security solutions which are targeted at the specific challenges which are inherent in securing a Smart Grid environment. Currently, NES has deployed its operational management solutions for over 1M meters in Americas, Europe and Middle-east. Its largest deployments are managing many 100K meters.

….For matured markets
The days of using data-centric solutions to meet operational needs, through expensive and bespoke customisation are drawing to a close. As agility and operational process specialisation becomes more important, tools which can be quickly deployed and provide in-built best-practice for operating IT-aligned grid infrastructure will become relevant. Increased focus on the security of the Smart Grid will drive the importance of dedicated security operations tools with in-built knowledge of how cyber-criminals will try to exploit the Smart Grid.

….For emerging markets
Although the focus is often on a rollout and achievement of the first generation of business benefits, the need to maintain the infrastructure in a mode that enables high-performance is increasingly in focus. This is driven the need for operational tools which guide the DSO through the extension of operational processes. From a security perspective, emerging markets often represent an “easy target” – although financial drivers for attack may not be present, the incentive to disrupt social energy schemes and government and NGO sponsored initiatives is very tempting.

….Proven consolidation through standards compliance
NES solution is designed to support any OSGP Smart Grid deployment. In fact, in one deployment, of over 400K meters, NES solutions are managing 3 OSGP vendors, with initiatives to introduce more OSGP vendors into that same network over the next few years.

A critical step utilities should be taking is to install monitoring and alarm systems to detect potential attacks.

Utilities should prepare to defend themselves against hackers attempting to access the grid via the new fleet of smart meters, says Emil Gurevitch, Senior Security Architect at Networked Energy Services (NES).

The industry is in a dilemma when it comes to cyber security, as while there is a need to share information, utilities do not want to talk openly for fear of exposing themselves to more threats or attracting negative press.

NES supplies smart meters to many countries in Europe, Middle East, Asia, Africa and Americas. In Europe, this includes Sweden, Finland, Denmark, Poland, Romania, France, Switzerland, Austria, Italy and Germany. Although many of these countries are less worried about the kind of national adversary threat that heightens tensions between the Ukraine, Russia, the US and China bring, there is a growing concern about criminal hackers looking to make financial gains or just disrupt the smart energy transition to make a name for themselves.

Wide attack surface
Not a lot of attention has been paid to smart meters, which is a relatively newer technology than SCADA systems for substation control and management of other parts of the smart grid, Gurevitch says. But clearly smart meter systems will become increasingly interesting for hackers as they create a wide attack surface with a varying range of security. There are easy ways to figure out what technology is out there, Gurevitch says. Public records of utility tenders and standards are all out in the open. A smart meter is very accessible – every home and office has one, normally in a private, out of the way place. Once the serial number is found, that can lead to an accurate account of what the technology is, and it can then be tested against known weaknesses.

The wave of smart meters being rolled out across Europe represents a huge investment, and utilities need to see a return on that expenditure – a single cyber-attack can wreck the business case a smart meter rollout. The life cycle of a smart meter is around 10-15 years, but that is a very long time in cyber security and a long time to be exposed to attack, Gurevitch says. Some utility executives understand the issue and are reviewing and improving their security posture, and some are in standby mode waiting for something to happen before taking action.  

A storm brewing
“Utilities have a chance to be proactive and anticipate attack rather than wait for something bad to happen. There’s a storm brewing and we have an opportunity to prepare for it,” he says.

Utilities should focus on monitoring, as at the moment many do not know what is happening at the grid edge Gurevitch says. “Some utilities are completely oblivious to the threat of attack, as if blindfolded.” Once monitoring systems are put in place and a threat is detected, the next stage is implementing the response. NES is developing such monitoring solutions in close collaboration with their utility customers and local partners.

Soon such security measures are likely be mandatory. There is a big push from the US regulator the Federal Energy Regulatory Commission, and Europe has several certifications and other initiatives underway.  

New threats
Europe has made a lot of progress and new smart meters have embedded security, while Asia and the Middle East are moving a little slower and are still in the development and deployment stage, says Nicolas Viot, head of the penetration testing team at Sogeti, part of the Capgemini group. He agrees with Gurevitch that one of the biggest challenges facing utilities is the length of time the smart meters will be in place. “In IT we are not used to supporting systems for such a long time,” he says. Future challenges include protection for end-user connectivity, as more consumers monitor consumption on mobile phones, smart homes and buildings solutions, smart cars, and digital rights management for example renting movies via smart TVs. “You have to look at new threats that will emerge,” he says. A future trend will be incorporating small producers of renewable energy into the grid, which will create a new cyber security challenge.

While it can be costly, it does not have to be, and cyber security spending will ultimately be worth it just like insurance, Gurevitch says. “Those investments will repay through reduced energy disruption, reduced loss of customer information and improved PR when these systems are subject to attacks by criminals.”