A new survey of 104 security professionals in the energy sector gave a big thumbs down to smart meter security.
According to the survey, when asked, “Do smart meter installations have sufficient security controls to protect against false data injection?” 61 percent said no. The report was sponsored by vulnerability management and compliance auditing firm nCircle and EnergySec, a public-private partnership funded by the U.S. Department of Energy. Its findings come roughly two weeks after NSA Director and US Cyber Command chief Gen. Keith Alexander spoke before the Senate Armed Services Committee about the importance of the government and private sector working together to stop security threats to the nation’s critical infrastructure.
“A false data injection attack is an example of technology advancing faster than security controls,” said Elizabeth Ireland, vice president of marketing for nCircle, in a statement. “This is a problem that has been endemic in the evolution of security and it’s a key reason for the significant cyber security risks we face across many facets of critical infrastructure. Installing technology without sufficient security controls presents serious risks to our power infrastructure and to every power user in the U.S.”
According to security blogger Brian Krebs, the FBI published a cyber intelligence bulletin that estimated that hacks against smart meter installations during the past several years may have cost an electric utility in Puerto Rico hundreds of millions of dollars annually. Citing confidential sources, the FBI said former employees of the meter manufacturer and employees of the utility were reprogramming the meters for money and then training others in how to do the same.
“These individuals are charging $300 to $1,000 to reprogram residential meters, and about $3,000 to reprogram commercial meters,” Krebs reported the FBI alert as stating.
Branden Williams, global CTO of marketing for EMC’s RSA security division, said that there is a mixture of technologies in the energy sector with vastly different life expectancies that have now been mashed together. This has impacted security, as industrial systems have life spans of 30 to 50 years, while IP-based systems find themselves obsolete after five to ten years. Depending on how interconnected those machines are, it may be either impossible or too costly to upgrade those IP systems in ways that will protect them from current threats, he explained.
“I suspect that once people dig into the dollars associated with the problem, action will take place,” he said. “For example, if a utility company learns they are losing 25 percent of their revenue to fraud, they would be much more willing to take action now that the number is real. Qualitative analysis will just spark discussions, no action.”
Smart meter manufacturers should take care to ensure they provide communication capabilities that meet basic integrity and confidentiality standards, such as rejecting non-authenticated traffic, he added.
“Smart meters vary widely in capability and many older meters were not designed to adequately protect against false data injection,” noted Patrick Miller, the founder, CEO and president of EnergySec, in a statement. “It doesn’t help that some communication protocols used by the smart meter infrastructure don’t offer much protection against false data injection either. Together, these facts highlight a much larger potential problem with data integrity across the smart grid infrastructure. Because our nation relies on the smart grid to deliver robust and reliable power, we need to make sure that all systems that process usage data, especially those that make autonomous, self-correcting, self-healing decisions, assure data integrity.”
*UPDATE: This story was updated to include commentary from RSA, EMC’s security division.
Related Reading: Fun and Games Hacking German Smart Meters
Related Reading: Smart Meters Interfering With Home Electronics
Related Reading: Grid Cyber Security – Removing the Reality Distortion Field