02:12 PM

Energy Department Sets Roadmap For Secure Infrastructure

Agency outlines strategies for developing energy-delivery systems that are resilient even in the face of cyberattack.

50 Most Influential Government CIOs
Slideshow: 50 Most Influential Government CIOs
(click image for larger view and for slideshow)
The Department of Energy (DOE) has released a roadmap for securing the nation's energy infrastructure that envisions an energy-delivery system able to withstand a major cyber attack and still continue to operate effectively.

The Roadmap to Achieve Energy Delivery Systems Cybersecurity outlines five strategies on which the government and private-sector organizations that own and control critical energy infrastructure should collaborate to create a secure and resilient energy-delivery system in the United States.

The September 2011 roadmap--prepared by the Energy Sector Control Systems Working Group, a private-public partnership of cybersecurity experts--is an update to one released in 2006 that takes into consideration the increased sophistication of today's cyberattacks, said U.S Energy secretary Steven Chu in a statement.

"Increased insight from private-public collaborations will allow us to better protect the nation's energy delivery systems that keep our lights on and the power flowing," he said.

[Which government agencies came out ahead in the IW500 competition? See 15 Government IT Innovators: InformationWeek 500.]

The plan calls for officials to create a culture of security that includes better risk-management practices that are periodically reviewed and challenged. This should ensure that security controls remain in place and continue to be effective even among changes to the energy-delivery system or emerging threats, according to the DOE.

Private and public stakeholders also should assess and monitor risk so they can respond to evolving cyberthreats and vulnerabilities, according to the roadmap.

Another aspect of the plan is an increased ability to manage cyber incidents when preventative measures aren't effective, according to the DOE. Stakeholders should put in place better detection, remediation, recovery, and restoration methods that can mitigate the impact of an incident, as well as conduct post-incident analysis and forensics to learn from attacks.

Finally, the roadmap calls for the energy sector to sustain security improvements by committing the resources to do so, as well as to ensure that collaboration between public and private stakeholders doesn't falter, according to the DOE.

The roadmap does note some barriers to achieving these goals. Among them are a shortage of skilled engineers and craft workers in the energy industry; limited knowledge, understanding, and appreciation of the security risks of energy-delivery systems; and a rapidly changing security risk environment.

Security experts long have worried about threats to U.S. critical infrastructure such as the power grid, and the Obama administration has implemented a number of initiatives--such as smart-grid collaboration and technology standards from the National Institute of Standards and Technology--to help the private sector to bolster security in this area.

Last year a research firm estimated that utility companies will invest more than $21 billion on cybersecurity by 2015 to protect the world's electrical grids.

In the new, all-digital issue of InformationWeek Government: As federal agencies close data centers, they must drive up utilization of their remaining systems. That requires a well-conceived virtualization strategy. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Current Issue
E-Commerce Security: What Every Enterprise Needs to Know
The mainstream use of EMV smartcards in the US has experts predicting an increase in online fraud. Organizations will need to look at new tools and processes for building better breach detection and response capabilities.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio