As we have previously reported, the effective  functioning of the electricity industry is highly dependent on these control  systems. This vision—the smart grid—would increase the use of IT systems and  networks and two-way communication to automate actions that system  operators formerly had to make manually. Other initiatives include adding “smart” components  to provide the system operator with more detailed data on the conditions  of the transmission and distribution systems and better tools to observe  the overall condition of the grid (referred to as “wide-area situational  awareness”). The use of smart grid systems may have a number of benefits, including  improved reliability from fewer and shorter outages, downward pressure  on electricity rates resulting from the ability to shift peak demand, an  improved ability to shift to alternative sources of energy, and an improved  ability to detect and respond to potential attacks on the grid. Smart Grid Is Potentially Vulnerable to a Variety of Cyber Threats

Threats to systems supporting critical infrastructure—which includes the  electricity industry and its transmission and distribution systems—are  evolving and growing. In February 2011, the Director of National  Intelligence testified that, in the past year, there had been a dramatic  increase in malicious cyber activity targeting U.S. computers and  networks, including a more than tripling of the volume of malicious  software since 2009.sources may adversely affect computers, software, networks,  organizations, entire industries, or the Internet. Intentional threats include both targeted and untargeted attacks  from a variety of sources, including criminal groups, hackers, disgruntled  employees, foreign nations engaged in espionage and information  warfare, and terrorists. Table 1 provides descriptions of common  types of cyber exploits. The potential impact of these threats is amplified by the connectivity  between information systems, the Internet, and other infrastructures,  creating opportunities for attackers to disrupt critical services, including  electrical power. Smart Grid Faces Cybersecurity Vulnerabilities

While presenting significant potential benefits, the smart grid vision and  its increased reliance on IT systems and networks also expose the  electric grid to potential and known cybersecurity vulnerabilities, which  could be exploited by a wide array of cyber threats. Securing Smart Grid Systems and Networks Presents Challenges

In our January 2011 report, we identified a number of key challenges that  industry and government stakeholders faced in ensuring the cybersecurity  of the systems and networks that support our nation’s electricity grid. As mentioned above, under EISA, FERC is  responsible for adopting cybersecurity and other standards that it  deems necessary to ensure smart grid functionality and  interoperability. However, FERC had not developed an approach  coordinated with other regulators to monitor, at a high level, the extent  to which industry will follow the voluntary smart grid standards it  adopts. We noted that without a good  understanding of whether utilities and manufacturers are following  smart grid standards, it would be difficult for FERC and other  regulators to know whether a voluntary approach to standards setting  is effective or if changes are needed. Lack of security features being built into certain smart grid systems. For example, according to experts from a panel convened by  GAO, currently available smart meters had not been designed with a  strong security architecture and lacked important security features,  such as event logging and forensics capabilities, which are needed  to detect and analyze attacks. Lack of an effective mechanism for sharing cybersecurity information  within the electricity industry. For example, experts stated that while  the industry has an information-sharing center, it had not fully  addressed these information needs. Without quality processes for information sharing, utilities  may not have the information needed to adequately protect their  assets against attackers. Lack of industry metrics for evaluating cybersecurity. The electricity  industry was also challenged by a lack of cybersecurity metrics,  making it difficult to measure the extent to which investments in  cybersecurity improve the security of smart grid systems. Until such metrics are developed, increased risk  exists that utilities will not invest in security in a cost-effective manner  or be able to have the information needed to make informed decisions  about their cybersecurity investments. Accordingly, in our January 2011 report, we made multiple  recommendations to FERC, including that it develop an approach to  coordinating with state regulators to evaluate the extent to which utilities  and manufacturers are following voluntary smart grid standards and  develop strategies for addressing any gaps in compliance with standards  that are identified as a result. FERC agreed with our recommendations and described steps the  commission intended to take to address them.
Why GAO Did This Study

The electric power industry is increasingly incorporating information technology (IT) systems and networks into its existing infrastructure as part of nationwide effortscommonly referred to as the smart gridaimed at improving reliability and efficiency and facilitating the use of alternative energy sources such as wind and solar. Smart grid technologies include metering infrastructure (smart meters) that enable two-way communication between customers and electricity utilities, smart components that provide system operators with detailed data on the conditions of transmission and distribution systems, and advanced methods for controlling equipment. The use of these systems can bring a number of benefits, such as fewer and shorter outages, lower electricity rates, and an improved ability to respond to attacks on the electric grid. However, this increased reliance on IT systems and networks also exposes the grid to cybersecurity vulnerabilities, which can be exploited by attackers. Moreover, for nearly a decade, GAO has identified the protection of systems supporting our nations critical infrastructurewhich include the electric gridas a governmentwide high-risk area.
GAO is providing a statement describing (1) cyber threats facing cyber-reliant critical infrastructures and (2) key challenges to securing smart grid systems and networks. In preparing this statement, GAO relied on its previously published work in this area.

What GAO Found

The threats to systems supporting critical infrastructures are evolving and growing. In a February 2011 testimony, the Director of National Intelligence noted that there had been a dramatic increase in cyber activity targeting U.S. computers and systems in the previous year, including a more than tripling of the volume of malicious software since 2009. Varying types of threats from numerous sources can adversely affect computers, software, networks, organizations, entire industries, and the Internet itself. These include both unintentional and intentional threats, and may come in the form of targeted or untargeted attacks from criminal groups, hackers, disgruntled employees, hostile nations, or terrorists. The interconnectivity between information systems, the Internet, and other infrastructures can amplify the impact of these threats, potentially affecting the operations of critical infrastructures, the security of sensitive information, and the flow of commerce. Moreover, the smart grids reliance on IT systems and networks exposes the electric grid to potential and known cybersecurity vulnerabilities, which could be exploited by attackers.
As GAO reported in January 2011, securing smart grid systems and networks presented a number of key challenges that required attention by government and industry. These included:
A lack of a coordinated approach to monitor industry compliance with voluntary standards. The Federal Energy Regulatory Commission (FERC) is responsible for regulating aspects of the electric power industry, which includes adopting cybersecurity and other standards it deems necessary to ensure smart grid functionality and interoperability. However, FERC had not, in coordination with other regulators, developed an approach to monitor the extent to which industry will follow the voluntary smart grid standards it adopts. As a result, it would be difficult for FERC and other regulators to know whether a voluntary approach to standards setting is effective.
A lack of security features built into smart grid devices. According to a panel of experts convened by GAO, smart meters had not been designed with a strong security architecture and lacked important security features. Without securely designed systems, utilities would be at risk of attacks occurring undetected.
A lack of an effective information-sharing mechanism within the electricity industry. While the industry has an information-sharing center, it had not fully addressed the need for sharing cybersecurity information in a safe and secure way. Without quality processes for sharing information, utilities may lack information needed to protect their assets against attackers.
A lack of metrics for evaluating cybersecurity. The industry lacked metrics for measuring the effectiveness of cybersecurity controls, making it difficult to measure the extent to which investments in cybersecurity improve the security of smart grid systems. Until such metrics are developed, utilities may not invest in security in a cost-effective manner or be able to make informed decisions about cybersecurity investments.
GAO made several recommendations to FERC aimed at addressing these challenges. The commission agreed with these recommendations and described steps it is taking to implement them.