Risk
3/12/2011
08:12 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

NERC Creates Cyber Assessment Task Force

The North American Electric Reliability Corporation (NERC) recently announced the formation of a Cyber Attack Task Force. The task force will be charged with identifying the potential impact of a coordinated cyber attack on the reliability of the bulk power system.

The North American Electric Reliability Corporation (NERC) recently announced the formation of a Cyber Attack Task Force. The task force will be charged with identifying the potential impact of a coordinated cyber attack on the reliability of the bulk power system.According to this release, the task force "will identify opportunities to enhance existing protection, resilience and recovery capabilities associated with power system operations practices, plans and procedures, as well as the tools and systems that operators rely upon to manage the reliable operation of the bulk power system."

The goal is to develop flexible options so that potential attacks can be spotted and rapidly mitigated.

So far, the task force comprises roughly 40 volunteers, and is chaired by Mark Engels, director of Information Technology Risk Management at Dominion. Charles Abell, supervising engineer of Transmission Operations Technical Support at Ameren Corporation, is vice chair.

The creation of the task force is part of the "Coordinated Action Plan" that was developed as part of a cooperative effort between NERC and the Department of Energy. That report concluded that the best way to manage a cyber event would be through a coordinated effort between the bulk energy industry and NERC-led initiatives. The June 2010 report, High Impact, Low Frequency Event to the North American Bulk Power System can be found here.

The resulting coordinated response to an attack that arrives from the Coordinated Action Plan is supposed to model "extreme conditions that would make bulk power system operations much more challenging than would normally be considered by electricity entities through their usual planning and preparedness activities," the initiative's scope document states.

A separate Smart Grid Security Task Force is being established to address security issues related to smart grid.

"NERC and the electricity industry have been actively addressing cybersecurity risks for some years now," said Gerry Cauley, president and CEO of NERC said in a statement. "This initiative will more thoroughly examine the potential impact of a targeted cyber attack and how the industry should best coordinate the preparedness and response actions of cyber security experts with power grid operators."

Let's hope so.

For my security and technology observations throughout the day, find me on Twitter.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, September 16, 2014
Malicious software is morphing to be more targeted, stealthy, and destructive. Are you prepared to stop it?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0985
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName parameter.

CVE-2014-0986
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the GotoCmd parameter.

CVE-2014-0987
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the NodeName2 parameter.

CVE-2014-0988
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode parameter.

CVE-2014-0989
Published: 2014-09-20
Stack-based buffer overflow in Advantech WebAccess (formerly BroadWin WebAccess) 7.2 allows remote attackers to execute arbitrary code via the AccessCode2 parameter.

Best of the Web
Dark Reading Radio