US plans to use "regressive" technology to promote grid defense

The Securing Energy Infrastructure Act would take a low-tech approach to improving the cyber defenses of the U.S. electric grid.

The United States has disclosed a plan to protect its power grid, intending to use "regression" technology to combat cyber attacks on the power grid.

The Energy Infrastructure Security Act aims to defend the U.S. energy grid by “working with industry to apply engineering concepts to eliminate vulnerabilities that could allow hackers to gain access to the grid by exploiting flaws in digital software systems.”

The bill, which was passed by the U.S. Senate on June 28, 2019, will explore options for replacing automated systems with low-tech methods, such as manual processes rather than networking, controlled directly by human operators.

The US government claims that this approach will greatly increase the difficulty of cyber attacks and thwart the most advanced cyber adversaries: if they want to access the power grid, they must actually access the relevant equipment.

Senator Angus King, who introduced the bill, said: Our world is becoming increasingly connected, bringing with it new opportunities and new threats.

“Connectivity is a strength, but if it’s not protected well, it can be exploited by our enemies. This bill takes an important step toward improving our defenses by protecting the electric grid that powers our lives from devastating attacks launched from halfway around the world.

The senator's staff said the bill was inspired by the 2015 cyberattack on Ukraine's power grid infrastructure, which left 225,000 people in the dark and cold during Christmas. The attack was blamed on neighboring Russia.

The attack, believed to have been carried out by the Russian-based hacker group BlackEnergy, was part of a series of attacks on Ukrainian infrastructure. A year later, further attacks have hit and the blackouts have occurred again.

The consequences of the attack would have been far more severe if Ukraine had not relied on manual technology to operate its power grid.

Some of the measures that will be taken in the plan include: using a two-year exploratory study to identify new security vulnerabilities and study attack mitigation systems; establishing a working group to evaluate technical solutions proposed by national laboratories; and requiring the Secretary of Energy to submit a report to Congress on the project's results.

Andrea Carcano, co-founder of Nozomi Networks, said that while the approach may reduce cyber risk, the operational impact should also be carefully evaluated.

He said that operational risk, security, process excellence and cyber risk cannot be decoupled. The power of industrial modernization is unstoppable and cannot be delayed. Companies and governments should take measures to steadily promote digital transformation instead of throwing the baby out with the bathwater.

In the case of national critical infrastructure, increased operating costs and reduced efficiency are tolerable as long as they can reduce perceived cyber risks, but this approach needs to be carefully balanced. This is not the case for manufacturing and industrial processes, where inefficiencies can lead to a decline in a company’s market competitiveness, which is absolutely unacceptable.