Securing the Smart Grid: Next Generation Power Grid Security [Paperback]

Tony Flick (Author), Justin Morehouse (Author)

Book Description

Publication Date: October 7, 2010 | ISBN-10: 1597495700 | ISBN-13: 978-1597495707 | Edition: 1

"The first step in securing the Smart Grid is to fully understand the threat landscape. This book provides both a timely and relevant overview of the subject - a must-read for anyone responsible for securing the grid as well as consumers looking to implement the technology!."-- Dr. Patrick Engebretson, Assistant Professor of Computer Security, Dakota State University.

"Easy to read and full of valuable information, this book provides a wide-eyed view of our future and the security challenges we will be facing in our day-to-day lives. Exploring everything from home systems to large-scale power plants, this is a must-read for everyone in our technological society."-- Thomas Wilhelm, ISSMP, CISSP, SCSECA, SCNA, SCSA, IEM, IAM

Smart Grids are the future of energy. By creating networks from power plant to home, utility companies will be able to regulate power consumption making sure that consumers are receiving the amount that is needed, no more or less. While this new use of networking technology and unique applications such as smart meters will help to conserve energy it also opens up a pipeline, that was regulated manually, into the computer world of interconnected networks. The infrastructure that is being built will need to have robust security as an attack on this network could create chaos to tens of thousands of power consumers, stop a utility company in its tracks, or be used in a cyberwar.

Securing the Smart Grid takes a look at grid security today, how it is developing and being deployed into now over 10 million households in the US alone. Direct attacks to smart meters as well as attacks via the networks will be detailed along with suggestions for defense against them. A framework for how security should be implemented throughout this growing system will be included directing security consultants, and system and network architects on how to keep the grid strong against attackers big and small.

Details how old and new hacking techniques can be used against the grid and how to defend against them

Discusses current security initiatives and how they fall short of what is needed

Find out how hackers can use the new infrastructure against itself

Editorial Reviews

Review

"The first step in securing the Smart Grid is to fully understand the threat landscape. This book provides both a timely and relevant overview of the subject - a must-read for anyone responsible for securing the grid as well as consumers looking to implement the technology!."-- Dr. Patrick Engebretson, Assistant Professor of Computer Security, Dakota State University.

"Easy to read and full of valuable information, this book provides a wide-eyed view of our future and the security challenges we will be facing in our day-to-day lives. Exploring everything from home systems to large-scale power plants, this is a must-read for everyone in our technological society."-- Thomas Wilhelm, ISSMP, CISSP, SCSECA, SCNA, SCSA, IEM, IAM

"Overall, Securing the Smart Grid: Next Generation Power Grid Security provides an excellent overview of the state of smart grid technology and its related security, privacy and regulatory issues. The book provides an excellent introduction for anyone looking to understand what smart grid is all about and its security and privacy issues."--Ben Rothke, Slashdot

About the Author

Tony Flick has been working in the Information Security field for more than six years and is currently a Principal with FYRM Associates. Mr. Flick has assisted numerous organizations in achieving compliance with federal regulations and industry standards. His expertise includes risk management and compliance, assessments and audits, and research in emerging technologies. Mr. Flick has presented at Black Hat USA, DEFCON, and the OWASP Tampa local chapter on smart grid and application security concepts. Mr. Flick holds the CISSP certification. Additionally, Mr. Flick earned a Bachelors of Science in Computer Science and a Bachelors of Science in Mathematics.

Justin Morehouse is an Information Security professional with over 10 years of experience assisting Fortune 100 companies and Federal Government Agencies mature their Information Security programs. Over the past six years Mr. Morehouse has focused on the areas of attack and penetration, performing nearly 200 Security Assessments utilizing both NIST SP800-42's "Blue Teaming” and "Red Teaming” approaches. Mr. Morehouse is the OWASP Tampa chapter leader and presented at IEEE's EntNet. Mr. Morehouse holds the following degrees and certifications: CISSP, CISM, MCSE, MSIA, and QSA (Former). He is currently an adjunct professor at DeVry University.

Product Details

• Paperback: 320 pages
• Publisher: Syngress; 1 edition (October 7, 2010)
• Language: English
• ISBN-10: 1597495700
• ISBN-13: 978-1597495707
• Product Dimensions: 7.5 x 0.9 x 9.2 inches
• Shipping Weight: 1.4 pounds (View shipping rates and policies)
• Average Customer Review: 3.6 out of 5 stars  See all reviews (9 customer reviews)
• Amazon Best Sellers Rank: #924,856 in Books (See Top 100 in Books)

More About the Author

Discover books, learn about writers, read author blogs, and more.

Most Helpful Customer Reviews

9 of 11 people found the following review helpful

3.0 out of 5 stars Decent general overview; provides good references for more in depth discussion of topics covered January 1, 2011

By Techie Evan

Format:Paperback|Amazon Vine™ Review (What's this?)

Smart power grids will depend on the deployment of software and devices that collectively will participate in the automated management of the production, transmission, and distribution of electric power. Some software and devices will also provide conveniences to consumers, such as the capability to remotely turn on and off smart appliances, and monitor or report power usage statistics in near real time. The introduction of such software and devices to our power grid provides benefits, but also introduces security risks because the software and devices are potential hacking targets.

This book provides a conceptual framework for thinking about such security risks and how to manage them by understanding who may want to attack smart grids, what their motives might be, how they might carry out their attacks, the potential impacts of those attacks, and good countermeasures and security practices to adhere to (e.g., threat modeling, code reviews, regular vulnerability assessments, network segmentation, encryption, strong passwords, etc).

The discussions cover a wide range of topics, including: how consumers and utility companies may suffer financially when hackers are able to compromise data integrity and cause inaccurate meter readings to be used as basis for billing; how the theft or interception of confidential information can be used against consumers or utility companies; and how denial of services attacks can be launched to make power unavailable to consumers. Although the discussions have breadth, they lack technical depth; instead, readers are referred to other references for more in depth discussions of specific topics.

The book consists of 14 chapters, almost a third of which is devoted to general descriptions of what the laws recently passed by the federal and various state governments require utility companies, and the vendors that work with them, to do to securely deploy smart grid technologies. The remaining chapters delve into smart grid topologies, what Confidentiality, Integrity and Availability mean as security concepts, what the potential impact of various attacks are on these three security pillars, and so on.

The book is easy to read but some of the information in a few chapters are quite redundant. If you already have exposure to analyzing security flaws and vulnerabilities in software and networks, this book may not provide much incremental value to you as it doesn't go much further beyond such analyses. But if you are a relative novice to security concepts and just want to get a general feel for how they apply to smart grids, then by all means, give this book your consideration.

2 of 2 people found the following review helpful

4.0 out of 5 stars A useful intro to Smart Grids, as well as security, with plenty of web links March 29, 2011

By Angela M. Hey VINE™ VOICE

Format:Paperback|Amazon Vine™ Review (What's this?)

This is a very readable, thoroughly referenced book on computer network security as applied to smart power grids, which are incrementally being installed by utility companies.

It starts with the history of power grids and then explains the features of the Smart Grid. The book has copious references and many weblinks to augment the text. It tells you how network routers can get attacked. It classifies vulnerabilities and describes risks. Whether you are consumer, beginning computer network manager or vendor of smart grid equipment this book provides a good introduction to security issues. Many of the threats will be well-known to computer network security experts

There is plenty in the book for consumers who are worried about what information may be leaked or compromised as a result of them reading smart meters online. For example, it discussed how to hack a router and the risks of social networking. The book is not just about the smart grid, it's more about the security of information networks, whether wireless or wired. Anyone interested in the security of their home or office computer systems will find useful material in the book.

The book discusses standards efforts and government initiatives. It provides a handy reference book for product managers in emerging technology companies that want to market network or customer premise equipment for power utilities.

Power and telecommunications utilities have considerable resources focused on protecting their infrastructure. This is not a book that covers the security of operations support systems in detail. It does however, look at general application level vulnerabilities. Where this book does not cover specifics such as the security of SCADA (supervisory control and data acquisition) systems, it does refer to existing works on the subject.

This book provides a good introductory overview of the issues that may be encountered in smart networks, with copious notes for those that want to read more. Much of the material in this book is changing and it may be useful to market the book annually so that it is kept current.

4 of 6 people found the following review helpful

5.0 out of 5 stars security for the smart grid consumer and enterprise January 26, 2011

By Ari Elias Bachrach

Format:Paperback|Amazon Vine™ Review (What's this?)

I've read plenty of infosec related books in the past, but none that do exactly what this one sets out to do - to take information security and apply it solely to a specific industry. The book starts by introducing the two fields - electric grids and information security. It then slowly brings the two disciplines together as it discusses the threats, vulnerabilities, and risks associated with smart grid technologies and devices. It is a very current book, discussing technologies that are currently available and in use and systems and largely ignoring the theoretical technologies which may or may not eventually exist. For example when discussing smart grid devices and social networking, something which I initially dismissed with a "pffft - who would ever do that?", they give actual live examples of locations and technologies (like the tweet-a-watt) that are distributing electricity usage information via social networking sites.

One of the things that surprised me the most about this book is that it's aimed simultaneously at the enterprise and the consumer. There are sections which talk about consumer electronics, and provide consumers safety tips, and there are sections which talk about enterprise web applications and other enterprise related systems.

The seasoned security professional will not learn a lot of new information about security here, but they will see it applied to a specific domain they may not have thought of before. The consumer interested in the security and privacy implications of smart grid technologies will get a great introduction to security. The employee of an electric company will also see an introduction to security that is highly relevant and meaningful to their industry. Overall while the focus is narrow, if it is appropriate to you, this is certainly a good book.