One of the key findings of the August 2003 Northeast Blackout was the need to modernize the electric grid. Upgrading older, less reliable electromechanical switches (cyber dumb) with highly reliable modern Intelligent Electronic Devices - IEDs (cyber vulnerable) was a cornerstone of this approach. The grid is certainly more reliable but much more cyber vulnerable because of these upgrades. The Aurora demonstration by the Idaho National Laboratory caused physical destruction of a diesel generator by exploiting the IED cyber vulnerabilities. Even with the NERC CIPs, there is still little control system cyber security training or addressing of Aurora.
One of the key findings of the 2010 San Bruno natural gas pipeline rupture that killed 8 was the lack of automated control valves (cyber vulnerable) to shut off gas following a pipeline rupture (http://news.yahoo.com/s/ap/20110205/ap_on_re_us/us_pipeline_explosion_warnings). Ironically, the San Bruno natural gas pipeline rupture was most likely due to an automated control valve causing a pressure increase the pipeline with poor welds could not handle. In this case, the SCADA system sent a signal to the control valve controlling the flow of gas to San Bruno to fully open. Unlike the electric industry with the NERC CIPs, the natural gas pipeline industry has no requirements for cyber security training.
What are NTSB and others going to do about remote shutoff valves making natural gas pipeline systems more cyber vulnerable than they are today?
Joe Weiss
