Risk
9/16/2011
02:12 PM
50%
50%

Energy Department Sets Roadmap For Secure Infrastructure

Agency outlines strategies for developing energy-delivery systems that are resilient even in the face of cyberattack.

50 Most Influential Government CIOs
Slideshow: 50 Most Influential Government CIOs
(click image for larger view and for slideshow)
The Department of Energy (DOE) has released a roadmap for securing the nation's energy infrastructure that envisions an energy-delivery system able to withstand a major cyber attack and still continue to operate effectively.

The Roadmap to Achieve Energy Delivery Systems Cybersecurity outlines five strategies on which the government and private-sector organizations that own and control critical energy infrastructure should collaborate to create a secure and resilient energy-delivery system in the United States.

The September 2011 roadmap--prepared by the Energy Sector Control Systems Working Group, a private-public partnership of cybersecurity experts--is an update to one released in 2006 that takes into consideration the increased sophistication of today's cyberattacks, said U.S Energy secretary Steven Chu in a statement.

"Increased insight from private-public collaborations will allow us to better protect the nation's energy delivery systems that keep our lights on and the power flowing," he said.

[Which government agencies came out ahead in the IW500 competition? See 15 Government IT Innovators: InformationWeek 500.]

The plan calls for officials to create a culture of security that includes better risk-management practices that are periodically reviewed and challenged. This should ensure that security controls remain in place and continue to be effective even among changes to the energy-delivery system or emerging threats, according to the DOE.

Private and public stakeholders also should assess and monitor risk so they can respond to evolving cyberthreats and vulnerabilities, according to the roadmap.

Another aspect of the plan is an increased ability to manage cyber incidents when preventative measures aren't effective, according to the DOE. Stakeholders should put in place better detection, remediation, recovery, and restoration methods that can mitigate the impact of an incident, as well as conduct post-incident analysis and forensics to learn from attacks.

Finally, the roadmap calls for the energy sector to sustain security improvements by committing the resources to do so, as well as to ensure that collaboration between public and private stakeholders doesn't falter, according to the DOE.

The roadmap does note some barriers to achieving these goals. Among them are a shortage of skilled engineers and craft workers in the energy industry; limited knowledge, understanding, and appreciation of the security risks of energy-delivery systems; and a rapidly changing security risk environment.

Security experts long have worried about threats to U.S. critical infrastructure such as the power grid, and the Obama administration has implemented a number of initiatives--such as smart-grid collaboration and technology standards from the National Institute of Standards and Technology--to help the private sector to bolster security in this area.

Last year a research firm estimated that utility companies will invest more than $21 billion on cybersecurity by 2015 to protect the world's electrical grids.

In the new, all-digital issue of InformationWeek Government: As federal agencies close data centers, they must drive up utilization of their remaining systems. That requires a well-conceived virtualization strategy. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-1414
Published: 2015-02-27
Integer overflow in FreeBSD before 8.4 p24, 9.x before 9.3 p10. 10.0 before p18, and 10.1 before p6 allows remote attackers to cause a denial of service (crash) via a crafted IGMP packet, which triggers an incorrect size calculation and allocation of insufficient memory.

CVE-2015-2072
Published: 2015-02-27
Multiple cross-site scripting (XSS) vulnerabilities in SAP HANA 73 (1.00.73.00.389160) and HANA Developer Edition 80 (1.00.80.00.391861) allow remote attackers to inject arbitrary web script or HTML via unspecified vectors to (1) ide/core/plugins/editor/templates/trace/hanaTraceDetailService.xsjs or...

CVE-2015-2075
Published: 2015-02-27
SAP BussinessObjects Edge 4.0 allows remote attackers to delete audit events from the auditee queue via a clearData CORBA operation, aka SAP Note 2011396.

CVE-2015-2076
Published: 2015-02-27
The Auditing service in SAP BussinessObjects Edge 4.0 allows remote attackers to obtains sensitive information by reading an audit event, aka SAP Note 2011395.

CVE-2015-2101
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in the Navigate bar in the Navigate module before 6.x-1.1 and 7.x-1.x before 7.x-1.1 for Drupal allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.