Official websites use .gov
A .gov website belongs to an official government organization in the United States.
Secure .gov websites use HTTPS
A lock (
) or https:// means you’ve safely connected to the .gov website. Share sensitive information only on official, secure websites.
Summary
Smart grid cybersecurity must address both inadvertent compromises of the electric infrastructure, due to user errors, equipment failures, and natural disasters, and deliberate attacks, such as from disgruntled employees, industrial espionage, and terrorists. NIST will address these challenges through research conducted in the NIST Smart Grid Testbed facility and leadership within the Smart Electric Power Alliance (SEPA) Cybersecurity Committee (SGCC) to evaluate of cybersecurity policies and measures in industry standards, and development of relevant guidance documents for the smart grid cybersecurity community. The primary goal is to develop a cybersecurity risk management strategy for the smart grid to enable secure interoperability of solutions across different domains and components. The Cybersecurity for Smart Grid Systems Project is moving forward to address the critical cybersecurity needs by promoting technology transfer of best practices, standards and voluntary guidance, and research in the areas of applied cryptography and cybersecurity for microgrids. This project will provide foundational cybersecurity guidance, cybersecurity reviews and recommendations for standards and requirements, outreach, and foster collaborations in the cross-cutting issue of cybersecurity in the smart grid.
Description
Objective: To develop the measurement science needed to advance the development and standardization of cybersecurity, including privacy, policies, measures, procedures, and resiliency, in the smart electric grid.
What is the new technical idea?
As a result of deployment of new smart grid technologies, the electric power industry is faced with new and changing cybersecurity threats, vulnerabilities, and the need for requirements applicable to the smart grid, both broadly and in specific areas such as applied cryptography, and cybersecurity for microgrids. The new technical idea is to adapt existing cybersecurity best practice methodologies and tools and to understand how to apply them in the electric sector, while identifying gaps and unique requirements for the grid that require new methodologies and tools. NIST will address these challenges through research conducted in the NIST Smart Grid Testbed facility, leading the Smart Electric Power Alliance (SEPA) Cybersecurity Committee (SGCC) to evaluate of cybersecurity policies and measures in industry standards, and develop relevant guidance documents for the smart grid cybersecurity community.
What is the research plan?
Device authentication and behavior analysis for edge grid devices in a smart grid environment
This project will investigate various means for device authentication within the smart grid environment. Researching practices already implemented in the IT space (x509 certificates, Trusted Platform Modules (TPM), etc) and how to implement them in a distributed grid system while mapping to their associated levels of assurance. In this project, a device authentication scenario will be implemented in the Smart Grid Test Bed and security features will be enabled to analyze their feasibility on devices. The first task will be to list the varying ways device identities can be stored within smart grid devices. The second task will be to implement these varying device identities and authentication mechanisms within the Smart Grid Test Bed. The end result will be a document that encapsulates the implementation, the performance results gathered, and discuss their implications of smart grid systems.
Smart Grid Architecture Cybersecurity Framework (CSF) Profile for Voltage Control
For this work effort, the Cybersecurity Framework (CSF) is being used to compare and contrast distribution system voltage control within two grid architectures—the previously-explored PNNL High-DER architecture and a current, conventional architecture. A CSF Profile would be the primary means of expressing these differences in the achievement of voltage control within the two architectures. The first task will consist of meeting with relevant stakeholders to understand voltage control within the context of a current, conventional architecture as well as within the previously-explored PNNL High-DER architecture. Special attention will be paid to compare & contrast voltage control strategies within the 2 architectures as well as the associated cybersecurity considerations.
The 2nd task will involve prioritizing CSF Subcategory outcomes for the delivery of voltage control within a current, conventional architecture as well as within the previously-explored High-DER architecture. Additionally, the team shall identify considerations for power system stakeholders in achieving voltage control and/or the desired cybersecurity outcomes within the architectures.
The 3rd task will involve documenting the target Profile—the prioritization of the CSF subcategories and associated cybersecurity considerations—in a NISTIR or NIST Technical Note. The Profile will compare/contrast the delivery of voltage control within the two different architectures (High-DER vs. conventional architecture) and the associated cybersecurity considerations for power system stakeholders. It is intended that the Profile will also incorporate updated NERC CIP to CSF mappings (i.e., current NERC CIP <-> CSF v1.1).
Examining the Cybersecurity Requirements of New Grid Architectures
A major finding of the Smart Grid Interoperability Framework, Revision 4, is that the logical interface categories of NISTIR 7628 are generally applicable to emerging interfaces in new system architectures, but that all security practices from the bulk power system may not be relevant to or useful for new domains in which those interfaces occur. The program will therefore explore the mapping of logical interfaces to the new system architectures, with a specific focus on identifying those cybersecurity practices that can be used for, or adapted to, the new interfaces. The work will also identify gaps in cybersecurity protections that may result from the different operational and integration requirements between the conventional Bulk Power System focused and the new DER focused logical interfaces.
Major Accomplishments
Technology Transfer Outcomes:
- NIST published its Draft NISTIR 7823 Advanced Metering Infrastructure Smart Meter Upgradeability Test Framework. The Draft NISTIR 7823 proposes an example test framework and conformance test requirements for the firmware upgradeability process for the Advanced Metering Infrastructure (AMI) Smart Meters. The conformance test requirements in the Draft NISTIR 7823 are derived from the National Electrical Manufacturers Association (NEMA) Requirements for Smart Meter Upgradeability standard, which defines requirements for Smart Meter firmware upgradeability in the context of an AMI system for industry stakeholders such as regulators, utilities, and vendors. Draft NISTIR 7823 identifies test procedures that the vendors and testers can voluntarily use to demonstrate a system's conformance with the NEMA standard.
Potential Technology Transfer Impacts:
- NISTIR 7628 Guidelines for Cyber Security (Volumes 1, 2, and 3) publication has achieved wide recognition and use for utilities, vendors, and regulators, and is also cited internationally. With input from the SGIP Smart Grid Cybersecurity Committee, NIST has completed and posted the first draft of (revised) NISTIR 7628 Guidelines for Smart Grid Cyber Security, Revision 1 for SGCC review and comment, with an additional public comment period planned before a final version is published
Realized Technology Transfer Impacts:
- NISTIR 7628 Guidelines for Cyber Security (Volumes 1, 2, and 3) publication has achieved wide recognition and use for utilities, vendors, and regulators, and is also cited internationally. With input from the SGIP Smart Grid Cybersecurity Committee, NIST has completed and posted the first draft of (revised) NISTIR 7628 Guidelines for Smart Grid Cyber Security, Revision 1 for SGCC review and comment, with an additional public comment period planned before a final version is published.