NIST Releases Initial Set Of Smart Grid Cyber Security Guidelines

The National Institute of Standards and Technology (NIST) issued recently its first Guidelines for Smart Grid Cyber Security, which includes high-level security requirements, a framework for assessing risks, an evaluation of privacy issues at personal residences, and additional information for businesses and organizations to use as they craft strategies to protect the modernizing power grid from attacks, malicious code, cascading errors and other threats.

The product of two formal public reviews and the focus of numerous workshops and teleconferences over the past 17 months, the three-volume set of guidelines is intended to facilitate organization-specific Smart Grid cyber security strategies focused on prevention, detection, response and recovery.

"As we modernize the nation's electric infrastructure to make it smarter, more efficient, and more capable, we need to make it more secure from end to end," U.S. Commerce Secretary Gary Locke said. "These new cyber security guidelines will help government and industry meet this important responsibility."

"The development of common Smart Grid standards is a national priority, and these cyber security guidelines are an important step toward that goal," said U.S Energy Secretary Steven Chu. "If we are to truly modernize our electrical grid, we must have electricity producers, distributors and consumers all speaking the same language and all working together to make our grid more secure. Cyber security is an integral part of the grid."

The new report was prepared by the Cyber Security Working Group (CSWG) of the Smart Grid Interoperability Panel, a public-private partnership launched by NIST with American Recovery and Reinvestment Act funding from the Department of Energy. The guidelines are the second major output of NIST-coordinated efforts to identify and develop standards needed to convert the nation's aging electric grid into an advanced, digital infrastructure with two-way capabilities for communicating information, controlling equipment and distributing energy.

Produced by the 450-member working group, with participants from academia and both the public and private sectors, the new guidelines elaborate on the cyber security overview in the group's first major output, the January 2010 NIST Framework and Roadmap for Smart Grid Interoperability Standards, Release 1.0. They provide the technical background and details that can inform organizations' efforts to securely implement Smart Grid technologies.

"These advisory guidelines are a starting point for the sustained national effort that will be required to build a safe, secure and reliable Smart Grid," said George Arnold, NIST's national coordinator for Smart Grid interoperability. "They provide a technical foundation for utilities, hardware and software manufacturers, energy management service providers, and others to build upon. Each organization's implementation of cyber security requirements should evolve as technology advances and new threats to grid security arise."

The report advocates a layered -- or "defense in depth" -- approach to security. Because cyber security threats are diverse and evolving, the report recommends implementing multiple levels of security.

The guidelines identify 137 interfaces -- points of data exchange or other types of interactions within or between different Smart Grid systems and subsystems. These are assigned to one or more of 22 categories on the basis of shared or similar functional and security characteristics. In all, the report details 189 high-level security requirements applicable either to the entire Smart Grid or to particular parts of the grid and associated interface categories. 

The new report also includes:

  • A description of the risk assessment process used to identify the requirements.
  • Discussion of technical cryptographic and key management issues across the scope of Smart Grid systems and devices.
  • Initial recommendations for addressing privacy risks and challenges pertaining to personal residences and electric vehicles.
  • An overview of the process that the CSWG developed to assess whether existing or new standards that enable Smart Grid interoperability also satisfy the high-level security requirements included in the report.
  • Summaries of research needs.

Under the Energy Independence and Security Act of 2007, Congress assigned NIST to coordinate development of a framework that would enable a Smart Grid that is safe, secure and interoperable from end to end. In its January 2010 report, NIST described a high-level conceptual reference model for the Smart Grid, identified existing or emerging standards relevant to the ongoing development of an interoperable Smart Grid, and spelled out several high-priority standards-related gaps and issues that NIST and its partners are now addressing.

All three volumes of Guidelines for Smart Grid Cyber Security (NISTIR 7628) can be downloaded at: http://csrc.nist.gov/publications/PubsNISTIRs.html#NIST-IR-7628.

Featured

  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Busy South Africa Building Integrates Custom Access Control System

    Nicol Corner, based in Bedfordview, Johannesburg, South Africa, is home to a six-star fitness club, prime office space, and an award-winning rooftop restaurant. This is the first building in South Africa to have its glass façade fully incorporate fritted glazing, saving 35% on energy consumption. Nicol Corner (Pty) LTD has developed a landmark with sophisticated design and unique architecture by collaborating with industry-leading partners and specifying world-class equipment throughout the project. This includes installing a high-spec, bespoke security and access control system. Read Now

  • Only 13 Percent of Research Institutions Are Prepared for AI

    A new survey commissioned by SHI International and Dell Technologies underscores the transformative potential of artificial intelligence (AI) while exposing significant gaps in preparedness at many research institutions. Read Now

  • Survey: 70 Percent of Organizations Have Established Dedicated SaaS Security Teams

    Seventy percent of organizations have prioritized investment in SaaS security, establishing dedicated SaaS security teams, despite economic uncertainty and workforce reductions. This was a key finding in the fourth Annual SaaS Security Survey Report: 2025 CISO Plans and Priorities released today by the Cloud Security Alliance (CSA), the world’s leading organization dedicated to defining standards, certifications, and best practices to help ensure a secure cloud computing environment. Read Now

Featured Cybersecurity

Webinars

New Products

  • QCS7230 System-on-Chip (SoC)

    QCS7230 System-on-Chip (SoC)

    The latest Qualcomm® Vision Intelligence Platform offers next-generation smart camera IoT solutions to improve safety and security across enterprises, cities and spaces. The Vision Intelligence Platform was expanded in March 2022 with the introduction of the QCS7230 System-on-Chip (SoC), which delivers superior artificial intelligence (AI) inferencing at the edge. 3

  • Camden CM-221 Series Switches

    Camden CM-221 Series Switches

    Camden Door Controls is pleased to announce that, in response to soaring customer demand, it has expanded its range of ValueWave™ no-touch switches to include a narrow (slimline) version with manual override. This override button is designed to provide additional assurance that the request to exit switch will open a door, even if the no-touch sensor fails to operate. This new slimline switch also features a heavy gauge stainless steel faceplate, a red/green illuminated light ring, and is IP65 rated, making it ideal for indoor or outdoor use as part of an automatic door or access control system. ValueWave™ no-touch switches are designed for easy installation and trouble-free service in high traffic applications. In addition to this narrow version, the CM-221 & CM-222 Series switches are available in a range of other models with single and double gang heavy-gauge stainless steel faceplates and include illuminated light rings. 3

  • AC Nio

    AC Nio

    Aiphone, a leading international manufacturer of intercom, access control, and emergency communication products, has introduced the AC Nio, its access control management software, an important addition to its new line of access control solutions. 3