Cyberthreats said to be increasing against grid
Private industry and government are paying more attention to cybersecurity, but the Government Accountability Office said control systems at such critical facilities "are more vulnerable (today) to cyberattacks than in the past."
Among reasons are the extensive use of the Internet and the systems' links.
Greg Wilshusen, the agency's director of information security issues, told a House Homeland Security subcommittee that the government has improved the security of power lines, nuclear plants, refineries and power stations.
Yet, he added, "there is yet no overall strategy to coordinate the various activities across federal agencies and the private sector."
The agency and several lawmakers said the Homeland Security Department is not doing enough to spread word about adequate standards for cybersecurity and threat information.
"The cyber-risk to these systems is increasing," said Democratic Rep. James Langevin, chairman of the subcommittee on emerging threats, cybersecurity and science and technology. "If this administration doesn't recognize and prioritize these problems soon, the future isn't going to be pretty."
Langevin noted the recent disclosure that government scientists at the Energy Department's Idaho National Laboratory were able to hack into a simulated power plant control system and cause an electric generator to destroy itself.
While the test was conducted on a small-scale system, experts said it showed the potential that a similar attack could disable huge generators and other equipment essential to power production.
Texas Rep. Michael McCaul, the subcommittee's top Republican, said the simulated attack last March was "a good news story" because it disclosed vulnerabilities. He said changes and improvements were made to reduce the risk. "We found it.... We fixed it," McCaul said.
Greg Garcia, assistant secretary for cybersecurity, told lawmakers that "we've known for some time that there are (cyber) vulnerabilities." He said Homeland Security is working with other agencies on standards and guidance to protect critical control systems.
Rep. Zoe Lofgren, another Democrat, pressed Garcia on what the department is doing to get more stringent standards to industry. Garcia said issuing such standards was a job for the Federal Energy Regulatory Commission.
"Our role is one of coordination," he said.
Lofgren said that was not the intent of Congress when it created the department. "We haven't made any progress in the cybersecurity side for a long, long time," she said.
The commission is considering more stringent standards for the electricity industry that a quasi-industry group, the North American Electric Reliability Corp., is developing.
Joe Weiss, a cybersecurity consultant, said private industry should have to comply with tougher standards that already apply to the government's critical infrastructure.
David Whiteley, the group's executive vice president, said its proposed standards "represent a significant improvement of cybersecurity for the electricity industry."
Related News

Groups clash over NH hydropower project
BANGOR, MAINE - Groups supporting and opposing the Northern Pass hydropower project in New Hampshire filed statements Friday in advance of a state committee’s meeting next week on whether it should rehear the project.
The Site Evaluation Committee rejected Eversource’s project last month over concerns about potential negative impacts. It is scheduled to deliberate Monday on Eversource’s request for a rehearing.
The $1.6 billion project would deliver hydropower from Canada to customers in southern New England through a 192-mile transmission line in New Hampshire.
If the Northern Pass project fails to ultimately win New Hampshire approval, the Massachusetts Department of Energy Resources has…