The good news
IBM has helped to evolve Internet security technologies, architectural frameworks and secure networks for high-risk industries such as banking and government, to the point where they can contribute much to keeping a smart grid secure.

Securing the smart grid is about "managing a continuum of risk" across all of the components of the grid, from the central power station through the network of substations down to the house meter. "It's about more than locking down data or access behind a firewall, which is simplistic," says Jeffrey Katz, chief technology officer for IBM's energy and utilities business. "It's important to understand the complex systems involved and build in controls within that context." And any security strategy must incorporate ongoing testing.

"Just the fact that the grid is smarter means that we can have more visibility into what's happening where," points out Katz. "We can detect outages and respond more quickly, redirecting power or shutting down a substation. Pick up abnormal incidents out in the network. Set parameters so that small events won't trigger bigger problems. Greater visibility into the grid in itself ultimately leads to better security."

Air gaps prevent network penetration
Even if a grid uses Internet protocol, (the type of messaging that occurs on the Internet) this does not mean there is a direct pathway from the external Internet to any point within the grid network, including meters. This is because "air gaps" physically separate critical control networks from public networks. Other techniques, including defensive application programming, firewalls and proxies, can set up a "moat" or separation between the private assets of the grid and the public Internet.

Software that defends against anomalies
A key consideration in securing a smart grid is the amount of software in the system. A critical best practice is defensive programming. This means that software should be written to be as predictable as possible in the wake of all unexpected data; this could be as simple as a data input that exceeds character count and produces an error message—and potential vulnerability to hackers. Source code must be as bug free as possible and comprehensible enough to perform well in all audits.

Analytics: patrolling the grid
Analytics software, such as IBM provides through its Solution Architecture for Energy and Utilities Framework (SAFE), provides the capability to monitor all of the inputs coming in through the smart grid network and can be programmed to flag events that indicate security breaches, such as suspicious patterns of usage or cessation of hourly readings. Beyond security analytics, operational analytics can even predict events, based on recognizing certain indicators, and automatically trigger preventive actions. "It's like putting more patrolmen on the streets," says Katz, "We gain observers at all points throughout the network." Also like patrolmen, vigilance should be maintained by security testing throughout the lifetime of the smart grid, not just for the duration of the original project.