Cybersecurity Is Key To Smart Metering Deployment
By Darren Oxlee, Chief Technology Officer and Director at Utility Systems
As adoption of advanced metering infrastructure (AMI) becomes more widespread, its appeal to cyber-attackers will undoubtedly increase, and addressing security vulnerabilities across layers — and by different stakeholders — must be taken into account from the outset.
This infrastructure essentially offers an integrated system of smart meters, communications networks, and data management systems that enable two-way communication between utilities and customers. Globally, we are seeing more requirements for automation at endpoints as utilities look to remotely diagnose and debug issues in the field.
In theory, every area of any system is open to risk: Because AMI allows for bi-directional communication and remote management of in-field devices, security breaches could allow unwanted changes to be made to device configuration and settings.
As such, stakeholders in the ecosystem need to take responsibility for ensuring their respective layer is secure and that the interfaces between vendors, system integrators, and utilities are as impenetrable as possible. AMI systems will have to adopt multi-layer security protocols to provide multi-level protection against potential threats.
AMI often applies to utilities that are of national significance, and failure to adequately secure systems against vulnerabilities can result in dire consequences for stakeholders and end users alike.
Among the challenges that operators face in securing their AMI systems is that there are currently no standards directly relating to AMI. There are, however, standards relating to the various components of an AMI system, and common to information and communication technology (ICT) installations, that operators still need to adhere to.
Security By Design
For example, radio communications is generally covered by IEEE 802.15.4 (the technical standard which defines the operation of low-rate wireless personal area networks), while data protection and privacy is covered by (amongst others) the EU’s General Data Protection Regulation (GDPR) or South Africa’s Protection of Personal Information Act (PoPI).
Other related standards that can help improve security of AMI systems include the ISO 27000 family, ISO 15408, RFC 2196, ANSI 62443, IEC 62443, and guidelines from a number of committees including TC CYBER, CISQ, NERC, and NIST. The European Union has proposed a standardized cybersecurity certification framework. It is likely that any locally developed government regulation will be based on standards such as the ones listed above.
Methods currently being used to combat breaches include secure data communications using encryption, secure database design, and proper access control using proven authentication methods, amongst others. In addition, cybersecurity is increasingly benefitting from intelligence-driven capability supported by machine learning.
The most important aspect is that each component of the AMI system be designed from the start with security in mind and the ability to adaptively react to threats based on continuous, intelligent risk profiling.
The correct implementation of security best practices prevents, as far as possible, breaches of complex systems, and allows AMI component manufacturers to develop skills in the area of cybersecurity that help protect customers from potential and unwanted cyber-attacks.
However, while utilities may often rely on service providers and vendors to comply with cybersecurity regulatory requirements, it is incumbent on all parties to adhere to the highest level of security as mandated by a global standard if possible.