Northwestern public power entities recently gathered at a summit on cybersecurity in Seattle, Washington, that drew more than 160 people searching for ways to combat threats to system integrity that could not have been imagined even two decades ago.
Utilities want to develop robust information sharing programs to warn each other of malicious activity. However, Washington's public disclosure law makes it difficult for public power utilities to easily share information with each other, and changes in the law might be necessary to allow for more inter-utility cooperation.
"We perform very limited real-time information sharing at this point, due to security and privacy concerns," said Paul Haase, Seattle City Light’s NERC Critical Infrastructure Protection Compliance Advisor. "Part of the summit was to develop personal relationships so that we have connections and contact with our neighbors in case of a cyber-emergency.”
The fourth Washington Cybersecurity Summit took place in late May and brought together officials from public and private organizations.
Speakers included leaders from Microsoft, T-Mobile, the Port of Seattle, Boeing, the Washington National Guard, Trovares, Alaska Airlines and Pacific Northwest National Laboratory.
For the Snohomish County Public Utility District, the PUD is focused on finding ways to strengthen its system against cyberattacks.
"In terms of physical security, we've done things to improve our substation protection" such as adding cameras and mesh fencing around the bulk of the substations, said Snohomish spokesman Neil Neroutsos.
One of the summit's themes, he said, was the need by utilities for "resiliency, and how we recover if and when it happens."
"Like any organization," Neroutsos said, "we get hit all the time where people are trying to get into our system.” But he noted that nothing major has happened.
Attendees heard about disruptive technologies that can stop a cyberattack dead in its tracks.
Seattle City Light officials said they heard about resources available for public power entities to share.
"There were three or four areas focused on," said Seattle City Light’s Haase. Information sharing was one of those areas.
Fundamentally, noted Jeff Brausieck, cyber security program manager for Seattle City Light, "we need to deliver reliable service to our customers and protect the business that surrounds and enables that mission.” He added, “We face many of the same cyber threats as any similar entity of our size."
Seattle City Light has about 450,000 customer accounts representing about 900,000 customers in Washington's largest city and seven suburban communities. The utility's generation consists of about 2,000 MW of hydropower.
The public power officials agreed it is becoming increasingly expensive to keep up with the ever-expanding cyber threat landscape while delivering reliable service and keeping customers safe.
"We're doing more things to strengthen systems," Neroutsos said. "We always need to be vigilant."
Later this summer, summit organizers plan to release a report outlining some common themes and areas to follow up on, such as the need for more training.
Copies of the report, Haase said, will be sent to U.S. Sen. Maria Cantwell, D-Wash., and Washington State Senator Guy Palumbo, both of whom spoke at the summit, as well as others.
Cantwell, Ranking Member of the Senate Energy and Natural Resources Committee, has been active on a number of fronts related to cybersecurity issues. For example, earlier this year, she introduced legislation that included a requirement that the Department of Energy develop curricula for energy sector-related cybersecurity, and establish a workforce advisory board with a cybersecurity member.
Along with Snohomish County PUD and Seattle City Light, the following public power entities from Washington State also participated in the summit: Tacoma Power, Benton County PUD, Grays Harbor PUD, Columbia REA, Chelan County PUD and Franklin County PUD.
