News / Articles

In an earlier white-paper, we questioned how to feed information into the ever-hungry maws of the big data and AI platforms, especially focusing on the information coming from the low-voltage grid.

The Question, Re-phased and Summarised
As the Smart Energy Transition picks up pace, the role of the smart grid is coming more into focus. A major driver are the initiatives of Electric Vehicle introduction, distributed and green energy production and storage, and energy community projects and micro-grid. These will have profound effects on the low-voltage grid, as this is where many of these initiatives are being delivered.
 Historically, it has been a major challenge to provide cost effective monitoring, management and control into the low-voltage grid. The result we have now, is a low-voltage grid which is essentially passive in nature with manageability limited to the “edges” of a black box and limited means to see and then control what happens within that black-box.
 

The Answer
The earlier White-paper described a series of “false dawns” where individual technology solutions presented possible solutions; big data and AI itself, IoT to gather information and connect devices, and then the smart meter. These solutions do not work in isolation, and it is only by integrating them into wider systems that it becomes possible to shine a spot-light on the low-voltage grid, and now it supports the Smart Energy Transition. In summary, the need is to have the measurement points in the low-voltage grid, enrich the information close to the source, connect multiple communications 
paths to the devices so that the strengths of multiple technologies can be combined and apply robust security to protect privileged information at source and in transit.
This then starts to drive the decision around investment in the low-voltage grid, especially in smart meters. The question for the procurement strategy for utilities is essentially: “With the major investments in big data and AI solutions, does it not make sense to focus investments on the sources of the information and the means of getting it? Isn’t the alternative simply wasting the opportunity to leverage the investment in the big data and AI platforms, and so have them become starved of information they need to justify their position?”.
 

A Survey
The results of a short survey conducted by NES, in conjunction with Smart Energy International, goes a long way to confirming some of these positions, and indicates where the utilities industry sits on this important issue. This survey was conducted in the course of a webinar addressing these specific issues which was attended by a blend of utilities, consultants, regulators and technology providers.

Around 75% of the respondents have investments either on-going or planned for big data and analytics for the low-voltage grid. This confirms the overall investment profile and the perception that it is important to gain more insight into this important part of the network.

An interesting dip in the next 12 months is an indicator of projects in wait status, possibly for external drives, such as regulation and technology capabilities, to establish themselves more clearly over late 2019 and 2020.

What is interesting here is the perception that the information is fundamentally not readily availability. This is clearly a reflection that unless supported by deployments of sophisticated smart meters and using these as sensors in the low-voltage grid, there is little available information. It also indicates that visibility within the black-box of the low-voltage grid is lacking. It may be possible to put some levels of manageability around the edges, but what happens inside is still unknown.

The second outcome was the reliability of getting to the information. This has been a major problem historically – whilst communications infrastructure exists, it is often not tuned to the specific demands of a smart meter deployment, and so reachability can be a challenge. This leads to the need for improved tooling for managing the communications outcomes – not communications network management but tooling to monitor SLAs on the business transactions of gathering information, and then using these to drive improvement plans. Related to this is the overall deployment of O&M tooling to keep the smart devices in the grid functioning properly.

Once availability and reliability improve, it is probable that the next bottle-neck will become throughout. The information will be there, and the challenge becomes how to get to it.

This next question focused more on the balance between procurement policies aiming to maximise margin by reducing cost and the need to invest in infrastructure. In the case of this survey, the underlying point is does the investment in the big data and AI solutions balance the investment in the equally important sensors and communications infrastructure in the low-voltage grid.

Currently, there seems to be a balance between future-looking functional requirements and the need to control costs. Interestingly, there is a very slight bias towards the future-looking functional requirements, which may indicate that procurement departments are starting to become aware of the need to invest in the low-voltage grid in order to leverage the investment in the big data and AI platforms.

The focus of this question was not just IT security generally, but specifically related to the increased deployment of advanced devices in the field, which, themselves, open up the opportunities for cyber-attack, directly as a result of their sophistication.

Unsurprisingly, people are generally very concerned. As more information is gathered from the low-voltage grid to feed big data and AI, there is more opportunity to capture that information, falsify it or simply block the flow. Whilst this is deemed to be simply operational data, the scope of impacts are limited to the utilities operational efficiency, but as more information comes from the smart meters, there is more of a perception that this is personal information. This brings GDPR (and similar legislation beyond Europe) into the equation.

What is interesting is that there are people who are only Moderately or Slightly Concerned; possibly driven by (1) the lack of publicised attacks, (2) the hope that it will happen to someone else and (3) technology will provide an answer in time.

NES Perspective on the Survey
NES provide smart grid devices and complementary operations, analytics and security software solutions.
Consequently, such results relate strongly to NES capabilities:

Devices
NES provides high-quality smart grid devices for the low-voltage grid which provide sensors, multiple communications options and protection of the valuable information. Investment in high-quality smart meters is the cornerstone of gathering information from the low-voltage grid.
All NES devices are built to these underpinning principles.

Analytics Software
NES provides enrichment of the sensor information by discovering the topology of the low-voltage grid, and then assessing phase balancing and energy flows within this grid. As well as providing for operational improvements and outage impact detection, this provides more of the information required to perform capacity and loading analysis in readiness for EVs, distributed generation, fraud/theft and community energy. This is the information required from the low-voltage grid to drive the Smart Energy Transition forwards. NES Grid Navigator and Grid Flow provide these functions.
 

Operations and Communications Monitoring Software
Operational efficiency and monitoring communications SLAs are a key aspect of maximising the information which can be gathered from the low-voltage grid by identifying areas of poor performance, and then using this to assess root-causes and resolve them. As well as the assuring the communications, robust O&M activities, supporting by tooling, ensure that the availability of the devices is maximised together with the communications. Finally, reception of events and alarms can also indicate problems in the low-voltage grid – the meter sees the symptoms of wider problems.
NES Grid Operations solutions implement both these key functions.
 

Security Software
The smart grid industry has focused on maintaining an IT security perimeter. Most ICT strategies now recognise that the perimeter will be breached, and protection in depth is required. This is achieved through intrusion detection and response systems.
NES Grid Watch provides intrusion detection and response solutions specifically for the devices now being deployed into the low-voltage Smart Grid.

Summary
A very interesting survey and thanks to all the contributed.
Overall, the results indicate that there is a significant on-going investment in big data and AI, specifically as it relates to the low-voltage grid. There is at least a balance between procurement policies of back-end analytics and sensors in the low-voltage grid compared to cost control, meaning that utilities recognise the dependency between the two areas of investment. Using the meters as a sensor is clearly a major opportunity, but more can be done to expose what is actually happening in the low-voltage grid black-box. Finally, getting all this information and keeping it secure is a major concern.
NES Smart Grid solutions are well placed to assist utilities as they move through the Smart Energy Transition and use Big Data and AI as a means to drive their business and technology decisions.

A critical step utilities should be taking is to install monitoring and alarm systems to detect potential attacks.

Utilities should prepare to defend themselves against hackers attempting to access the grid via the new fleet of smart meters, says Emil Gurevitch, Senior Security Architect at Networked Energy Services (NES).

The industry is in a dilemma when it comes to cyber security, as while there is a need to share information, utilities do not want to talk openly for fear of exposing themselves to more threats or attracting negative press.

NES supplies smart meters to many countries in Europe, Middle East, Asia, Africa and Americas. In Europe, this includes Sweden, Finland, Denmark, Poland, Romania, France, Switzerland, Austria, Italy and Germany. Although many of these countries are less worried about the kind of national adversary threat that heightens tensions between the Ukraine, Russia, the US and China bring, there is a growing concern about criminal hackers looking to make financial gains or just disrupt the smart energy transition to make a name for themselves.

Wide attack surface
Not a lot of attention has been paid to smart meters, which is a relatively newer technology than SCADA systems for substation control and management of other parts of the smart grid, Gurevitch says. But clearly smart meter systems will become increasingly interesting for hackers as they create a wide attack surface with a varying range of security. There are easy ways to figure out what technology is out there, Gurevitch says. Public records of utility tenders and standards are all out in the open. A smart meter is very accessible – every home and office has one, normally in a private, out of the way place. Once the serial number is found, that can lead to an accurate account of what the technology is, and it can then be tested against known weaknesses.

The wave of smart meters being rolled out across Europe represents a huge investment, and utilities need to see a return on that expenditure – a single cyber-attack can wreck the business case a smart meter rollout. The life cycle of a smart meter is around 10-15 years, but that is a very long time in cyber security and a long time to be exposed to attack, Gurevitch says. Some utility executives understand the issue and are reviewing and improving their security posture, and some are in standby mode waiting for something to happen before taking action.  

A storm brewing
“Utilities have a chance to be proactive and anticipate attack rather than wait for something bad to happen. There’s a storm brewing and we have an opportunity to prepare for it,” he says.

Utilities should focus on monitoring, as at the moment many do not know what is happening at the grid edge Gurevitch says. “Some utilities are completely oblivious to the threat of attack, as if blindfolded.” Once monitoring systems are put in place and a threat is detected, the next stage is implementing the response. NES is developing such monitoring solutions in close collaboration with their utility customers and local partners.

Soon such security measures are likely be mandatory. There is a big push from the US regulator the Federal Energy Regulatory Commission, and Europe has several certifications and other initiatives underway.  

New threats
Europe has made a lot of progress and new smart meters have embedded security, while Asia and the Middle East are moving a little slower and are still in the development and deployment stage, says Nicolas Viot, head of the penetration testing team at Sogeti, part of the Capgemini group. He agrees with Gurevitch that one of the biggest challenges facing utilities is the length of time the smart meters will be in place. “In IT we are not used to supporting systems for such a long time,” he says. Future challenges include protection for end-user connectivity, as more consumers monitor consumption on mobile phones, smart homes and buildings solutions, smart cars, and digital rights management for example renting movies via smart TVs. “You have to look at new threats that will emerge,” he says. A future trend will be incorporating small producers of renewable energy into the grid, which will create a new cyber security challenge.

While it can be costly, it does not have to be, and cyber security spending will ultimately be worth it just like insurance, Gurevitch says. “Those investments will repay through reduced energy disruption, reduced loss of customer information and improved PR when these systems are subject to attacks by criminals.”

Smart grids are a critical national resource, and like any other, are subject to cyber attack. To date, smart grid cybersecurity strategies have focused on the perimeter. What happens when an attack is successful, and a cybercriminal gets past the perimeter? This is when defence in depth is needed.

A tempting target

A smart grid is a DSO’s (Distribution System Operator) largest investment and a national asset upon which mission critical and life-saving services rely. Government, business and residents rely on the service it provides every second of the day. It provides the energy supplier with their revenue, and through it, the DSO has access to highly privileged and sensitive customer information.

To achieve the social and economic benefits of a smart grid, sophisticated equipment has been deployed further into the less regulated and secured low-voltage grid. Whilst this meets the objectives for smart grid, it creates more points of entry that a cyber-criminal can exploit.

High profile and prestige smart city initiatives depend on smart grid for efficiency and optimisation – a successful attack could bring a smart city to its knees. So, these targets are attractive for extortion or high profile disruption – both motivators for financial and hostile government sponsored attackers.

These are not the only attractive targets – terrorism motivated attacks focus on many targets across the globe. Potentially all smart grids are a target to attacks focused on political or sectarian drivers.

Is protecting the perimeter enough?

The Information and Communications Technology (ICT) industry has found, to its cost, that relying on perimeter defence against cybercriminals is insufficient. A perimeter is a combination of ICT, processes and people. Even where the ICT piece achieves high theoretical protection, it is the process and the people that can create “loop-holes”, which the cyber-criminals are highly skilled at exploiting.

This is equivalent to relying solely on the strength of your locks to your home and hoping that no one else has a key or can pick the lock!

Modern cybersecurity solutions are a combination of defence in depth with the assumption that, eventually, protection will be breached. This means that only when detection and response are coupled with protection, is it possible offer a comprehensive defence.

If the smart grid was your home, you would be subscribing to a local community watch project (to monitor general threat), installing video cameras in front of your door (to monitor specific threat) and installing a burglar alarm within your home (to monitor for successful intrusion).

How strong can the perimeter be?

The smart grid is increasingly complex. Upgrading the perimeter to the latest standards may simply be too disruptive and time-consuming to do quickly and in response to new attack mechanisms. The reality is that the attacker always has the initiative and technology will lag – both in creating the solution and deploying it across national infrastructures.

The perimeter will always be porous.

If the smart grid was your home, you would be changing the locks every week!

Is visibility of security events enough?

Even if a DSO is aware of security events, they can be missing important indicators of attack, simply because they are lost in the background of low-level threat indicators and false positives. Common responses are to log everything or log nothing. In either case, some DSOs may be unable to spot the key indicators which would allow them to adopt a modified security posture in response to a threat or to react to block an attack or limit a penetration.

Making sense of all the information

A key concept implemented in many SIEM (Security Information and Event Management) systems is correlation of large volumes of isolated and (potentially) false positive events against a wide set of contextual information. Such context may include scheduled events, topological or geographical information, known threat information, historic information, known and anticipated methods of attack and actual attack elsewhere.

The challenge is that ICT SIEMS are focused on ICT infrastructure and do not have built-in “understanding” of smart grids to make sense of the specific information or context.

What is required in a SIEM is the ability to:

• Monitor the smart grid without interrupting or disrupting the key service it offers
• Interpret events from the smart grid
• Have the right context by which to assess these events
• Identify and be familiar with the types of attacks, which are specific to a smart grid,
• Have awareness of attacks across a community.

With this new generation of SIEM, it is possible to build a defence in depth for the smart grid.

Outcomes of defence in depth

With such a SIEM in place, the DSO can defend itself in depth, and not rely on solely on the perimeter.

This is a little like being in the community crime watch, having a security camera outside your house and a burglar alarm inside. To continue the analogy, a home owner may even accept older locks if they have the deterrent and defence in depth.

Defence in depth provides for:

• Evaluation of the current threat-level and changes over short, medium and long-term
• Detection of a specific threat and initiation of responses to harden the smart grid in readiness for attack
• Detection of attack and initiation of responses to protect the infrastructure within the perimeter
• Detection of a successful intrusion and initiation of responses to limit damage
• Shared information across a community concerning threat level and actual attacks
• Localisation of the threat with the opportunity to go on the offensive against the cyber-criminal!

The business outcome

DSOs with such an SIEM will be less vulnerable to denial of service attack or ransom, theft of corporate or customer information, theft of smart grid infrastructure, and may also enjoy lower corporate insurance premiums.

The social outcome

Consumers will be less vulnerable to disruption of supply and publication of personal information.

About NES and Grid Watch

Networked Energy Services (NES) provides Smart Metering and Smart Grid products and services including industry leading security solutions. NES Grid Watch provides additional defence in depth beyond the Smart Meter perimeter.