Group defines cyberattack prevention rules for nation's power grid

Federal Energy Regulatory Commission sets infrastructure standards

By Ellen Messmer, Network World, 01/17/08

 Start a discussion    Print article

 Comments (1)    Print article

The Washington-based Federal Energy Regulatory Commission today approved eight "critical infrastructure protection" (CIP) standards intended to protect the electric-power grid operated by the nation's utilities from coming under cyberattack because of poor access control, software vulnerabilities or other weaknesses in their data-control systems.

FERC, which has regulatory authority over U.S. electric and gas utilities, decided in a unanimous vote to require that users, owners and operators of what's called the "bulk power system" for electricity, to establish policies and plans to safeguard physical and electronic access to control systems, according to the eight CIP principles. FERC Chairman Joseph Kelliher called the commission's decision a milestone in "adopting the first mandatory and enforceable reliability standards that address cybersecurity concerns on the bulk power system in the United States."

These standards, in summary, are:

* Critical cyberasset identification
* Security management controls
* Personnel and training
* Electronic security perimeters
* Physical security of critical cyberassets
* Systems security management
* Incident reporting and response planning
* Recovery plans for critical cyberassets

The CIP standards were proposed by the North American Electric Reliability Corporation (NERC), which FERC has designated as the organization that will oversee compliance with them.

During the FERC public meeting today, Kelliher said that adoption by the energy industry of the eight CIP measures would work to deter "any organized group that might be intentionally trying to disrupt the grid."

FERC Commissioner Jon Wellinghoff called the decision by the FERC an important one to better secure an interconnected grid system, but Commissioner Philip Moeller raised the question of whether the country would end up with a "more disconnected bulk-power grid as a way to defend against a cyberattack."

In discussing its decision to adopt the CIP standards to regulate the bulk-power grid, FERC acknowledged that it had received many comments from the power companies related to the concern that the older data-control equipment they have in place today is not designed to adhere to strict security guidelines that might entail software patching or running security and management software.

About Network World, Inc. | Advertise | Careers | Contact us | Terms of Service/Privacy | Reprints and links | Partnerships | Press room | Subscribe to NW

Copyright, 1994-2008 Network World, Inc. All rights reserved.