Six new university-based cybersecurity centers will work to protect the power grid, including by creating cybersecurity training programs
This effort is powered by a two-year grant from the Department of Energy's Office of Cybersecurity, Energy Security, and Emergency Response (CESER). The university partners with regional energy sector operators, vendors, national laboratories, and other higher education institutions.
Dr. Daniel G. Cole, principal investigator on the project at the University of Pittsburgh and assistant professor in the Department of Mechanical Engineering and Materials Science, said traditional energy infrastructure struggles with legacy systems that are difficult to maintain. Carriers have long been reluctant to upgrade technology for fear of disrupting systems that cannot afford downtime.
The Pittsburgh project aims to use digital twins to investigate the ability of energy systems to resist cyber-attacks.
The modernization of the power grid also raises new concerns. Dr. Junbo Zhao, principal investigator on the project at the University of Connecticut and associate director of the Eversource Energy Center, said the grid will increasingly involve small, distributed energy resources that communicate over public networks. He said that Successful attacks on these smaller organizations could allow threat actors to penetrate broader power systems, added Dr. Emmanouille Anagnostou, a professor in the Department of Civil and Environmental Engineering.
To address this, the Connecticut project aims to develop tools to reduce the impact of cyber-attacks on distributed energy resources and allow them to be brought back online quickly. Solutions must be comprehensive, considering how energy businesses combine both information and technology, Zhao said.
Meanwhile, Iowa State University aims to provide real-time situational awareness and envisions anomaly detection using machine learning on edge devices, which will report to a cloud-based control center. Manimaran Govindaras, an engineering professor at Iowa State University and principal investigator on the project, said this provides a consistent view of the entire system.
But Mohammad Ashkur Rahman, principal investigator and associate professor in the Department of Electrical and Computer Engineering at Florida International University, says any cyber tool must be cost-effective for infrastructure providers; He said electricity prices could rise. Security measures must also not compromise the reliability of the power grid.
The university is working on a moving target defense solution that disguises the defender's infrastructure, making it difficult for attackers to understand target systems and make attack planning difficult. For example, such a solution could confuse an attacker by making the data appear to come from a different source than it actually is.
And technology is only part of the solution. Pittsburgh is also collaborating with the Institute for Cyber Law, Policy, and Security to understand the impact of policy and other factors on the adoption of security measures. Organizations in the energy sector need to understand the potential barriers to improving cybersecurity and the policies that apply.
“you [could] I dream of a great technological solution, but for certain reasons related to legal barriers or something, I can't adopt it. ” Cole said.
Universities work with many partners, more than 20 in the case of Connecticut. This includes members from other universities, national laboratories, and industry. Feedback from industry will help ensure the solution is used in practice, Cole says.
Iowa's Govindaras said the partnership will create a dialogue between previously isolated power companies and encourage further cooperation in the cyber field. The university also intends to train people who can secure the power grid.
“There's a shortage of cybersecurity experts to begin with,” Cole said. “And there are even fewer cybersecurity professionals who are adept at working with operational technology systems.”
Some universities are considering developing new curricula. That might mean bringing together cyber-focused computer science students and engineering students to provide cross-training opportunities. Initiatives proposed by Florida International include annual workshops with industry networking opportunities for students and mentoring for postdoctoral fellows. Some universities offered internships at partner companies or national laboratories. Connecticut is also considering creating a website to host resources.
