In my post yesterday, I expressed my surprise at how easily I could find information about what I consider to be the two most critical types of control systems used on the electric power grid: energy management systems (EMS) used in Control Centers and protection relays used in Transmission substations.
For both of these types of systems, I easily learned what vendor and model are used by more than three major electric utilities, just by asking one of two helpful AI chatbots. I never got a warning that the bot couldn’t share that information with me, even though I was denied when I asked how to build an atomic bomb. I don’t think the chatbots were utilizing non-public information (they cited what appeared to be public sources), so my next question became, “Why was it so easy for me to get this information?
The NERC CIP cybersecurity standards, which apply to control systems that monitor and operate the Bulk Electric System (BES), restrict distribution of “BES Cyber System Information (BCSI)”. The definition is a long one, but the first “sentence” is “Information about the BES Cyber System that could be used to gain unauthorized access or pose a security threat to the BES Cyber System.” An EMS system and protection relays used in Transmission substations are definitely BES Cyber Systems, and knowing the vendor and model can certainly be useful in gaining unauthorized access to the systems.
The answer probably lies in the second sentence of the BCSI definition: “BES Cyber System Information does not include individual pieces of information that by themselves do not pose a threat or could not be used to allow unauthorized access to BES Cyber Systems, such as, but not limited to, device names, individual IP addresses without context, ESP names, or policy statements.” My guess is that, if I asked one of the utilities whose information I requested when I was writing yesterday’s post whether the vendor and model number of their EMS system or protection relays were BCSI, they would say no, because of the second sentence.
Up until a month or so ago, I would have agreed with the utilities, since I couldn’t imagine how an individual attacker (human or bot) would be able to find the EMS on the utility’s network just by knowing the vendor and model number; they would need much more information than that.
However, a swarm of maybe thousands of bots can quickly scan every corner of the internet for any information that might be relevant. At that point, the attack will be much more likely to succeed, although there’s still the much harder problem of getting access to the utility’s OT network in the first place. But given the amazing things that huge bot swarms can do (like solving a centuries-old math problem, with a promised prize of $1 million for a solution, in 88 hours), I’m not willing to say there’s any system or network that the bots could never penetrate, unless access requires the active intervention of a trustworthy and knowledgeable human being.
This means it’s time for the NERC community to revise the BCSI definition. I think cutting it down to just the first sentence would be fine for now.
Tom Alrich’s Blog, too is a reader-supported publication. You can view new posts for three months after they come out by becoming a free subscriber. You can also access all of my 1300 existing posts dating back to 2013, as well as support my work, by becoming a paid subscriber for $30 for one year (and if you feel so inclined, you can become a founding subscriber for $100). Whether free or paid, please subscribe.Â
If you would like to comment on what you have read here, I would love to hear from you. Please comment in my chat or email me at [email protected].
Â
Â