Published 4Q Bob Lockhart Senior Analyst. Bob Gohn Research Director

Transcription

1 EXECUTIVE SUMMARY: Smart Grid Cyber Security System Reliability, Defense-in-Depth, Business Continuity, Change Management, Secure Telecommunications, Endpoint Protection, Identity Management, and Security Event Management NOTE: This document is a free excerpt of a larger report. If you are interested in purchasing the full report, please contact Pike Research at sales@pikeresearch.com. Published 4Q 2011 Bob Lockhart Senior Analyst Bob Gohn Research Director

2 Section 1 EXECUTIVE SUMMARY 1.1 Introduction How much can an industry change in one year? In the case of smart grid cyber security, the answer is quite a lot. This report began as an update to Pike Research s 2010 report, Smart Grid Cyber Security, but ended up as a complete rewrite. That much change has occurred. One year ago, Stuxnet had only recently been discovered. A year s worth of analysis still has not unlocked all its secrets, but it has had a profound influence on the smart grid cyber security market. Utilities have as many predicted a year ago realized that their grids are no longer isolated or protected from attackers. Adding more intelligence to grid assets will increase the attack surface and utilities are now aware of this. The hype around smart grid cyber security, especially smart meter security, has died down from a year ago. Pike Research believes that this is because many of the projects and products announced in the past are now being implemented. New products and new deals generate press, but the actual deployments tend to be ignored. Our research indicates that a lot of people are working really hard to deploy products. Some things have not changed. The cultural chasm between IT and operations technology (OT) remains at many utilities, although Pike Research is hearing more optimistic stories about reconciliation, or at least peaceful coexistence, between IT and OT. As a whole, both groups appear to have realized that they have cyber security problems, and that neither can live without the other. Cyber security remains a check-in-the-box exercise for many, with spending limited to whatever is needed to survive compliance audits. As some technologies near a decade of thought and deployment, such as smart metering, the approach to cyber security has become more thoughtful. However, newer technologies, such as control system automation, still focus more on just getting it to work, with cyber security as an afterthought; or a never-thought. 1.2 Market Landscape Market drivers have appeared or gained importance during the past year. European smart metering deployments that were in early stages a year ago are into the deployment phase, even if targeted completion dates stretch beyond The North American Electric Reliability Corporation (NERC) has begun issuing fines for non-compliance with its critical infrastructure protection (CIP) reliability standards. Utilities believe that they will see greater benefits from distribution automation (DA) than from advanced metering infrastructure (AMI) and Pike Research forecasts greater spending in that area. The market for home energy management (HEM) and home area networks (HANs) appears to be in disarray as this report is published. Microsoft, Google, and Cisco have all made well publicized exits from the HEM market, leaving some to doubt its viability. Pike Research does not doubt that market s viability, despite the fact that many problems have not yet been conclusively resolved. HAN standards that were thought to be settled a year ago are now in doubt. The continuing recession inhibits consumers from purchasing newer 1

3 HAN-enabled appliances in numbers that would support a HEM market. This report forecasts that 63% of smart grid cyber security investment for 2011 through 2018 will be primarily in control system segments including: transmission upgrades, substation automation, and DA. By comparison, many cyber security vendors still focus on IT security functions, such as AMI security. 1.3 What Has Changed in a Year Cyber security vendors report that now they are spending a lot more time speaking with utility operations groups, no longer meeting only with security managers or CIOs. Vendors tell us that utility operations teams have increased their cyber security savvy over the past months and are now open to discussions about protection products, sometimes demanding those discussions. Utilities are asking better questions about cyber security, although some education is still needed when a security vendor first calls on a utility. Nearly all security and technology vendors have told us that they will add more security to their products when the utilities start asking for it, which appears to have begun during the past 12 months. Hackers appear to have moved on to other industries: not nearly as many stories are heard about smart meter vulnerabilities. Pike Research does not view this as a positive development. One speaker at a recent conference said, Do not fear hackers. Fear engineers who hack. That is how nation-states attack, and the relative quiet in the press may be the calm before the storm. Stuxnet was in the wild and doing its thing for over a year before anyone noticed. We have also detected some signals that early adopters of technologies especially AMI may now be concerned that they did not include sufficient cyber security in their deployments. We believe this is because the state of cyber security capabilities has advanced, as has the awareness of cyber security issues. Opportunity may arise for cyber security retrofits into large AMIs, although we have not seen any yet. Unfortunately, one thing has not changed. Cyber security is still way behind the attackers. Even with strong countermeasures in place, they are not consistently deployed. More sophisticated attackers look at smart grids from a systemic perspective, while often the defenses have been installed in piecemeal fashion, without an architecture in place. This hands an enormous advantage to the attackers. 2

4 1.4 Key Technologies for Smart Grid Cyber Security This report assesses the threats and vulnerabilities that confront smart grid technologies, arriving at a list of most likely cyber security investments. This list is not in priority order, but roughly in the sequence of activities from the beginning to the end of a cyber security program: Identify and access management Multi-factor authentication Defense-in-depth security Role-based access control (RBAC) Perimeter security devices, such as firewalls and intrusion detection or prevention Redundant or backup communications routing, using different physical layers Application whitelisting Restricted use of removable media Embedded device security Antivirus software One-way data communication technologies Ruggedized devices Security overlays on legacy systems, sometimes called bump-in-the-wire Device-to-device authentication Network and device resiliency Change management Software patch management, especially for control networks Security event logging and correlation Situational awareness Compliance assurance Security incident response Cyber forensics Business continuity planning (BCP) 3

5 1.5 Market Forecast Pike Research forecasts that cumulative smart grid cyber security revenues from 2011 to 2018 will reach $14 billion. Chart 1.1 shows the annual revenue forecast, segmented by geographic region. The forecasts yield an 8-year compound annual growth rate (CAGR) of 9.6%. Further charts within the report show the same total revenue distributed by the five smart grid segments: transmission updates, substation automation, DA, electric vehicle (EV) infrastructures, and smart metering. The report also includes charts of revenue by each of these segments for each region, and an allocation of smart grid cyber security revenue by IT versus industrial control system (ICS) functions. Chart 1.1 Smart Grid Cyber Security Revenue by Region, World Markets: $2,500 $2,000 ($ Millions) $1,500 $1,000 Middle East & Africa China Western Europe North America Asia Pacific except China Eastern Europe Latin America $500 $ (Source: Pike Research) The forecast shows a plateau beginning in 2015, with a slight decrease toward the end of the forecast period. The plateau is a result of increasing infrastructure expenses especially in large developing economies offset by the commoditization of cyber security products that today are considered new technologies. The unavoidable observation from Chart 1.1 is that China will drive a large proportion of smart grid security spending. Within the report, it becomes apparent that a significant portion of the spending in China will be related to transmission grids. While it is our responsibility to forecast a global market, we are unsure whether or not the Chinese market will be addressable by foreign companies. Regardless, with that much revenue at stake, we cannot think of a good reason to avoid the market. Finally, as it is possible to compare like-for-like numbers with this report s predecessor from one year ago, those numbers have increased this time around. This is partially due to more granular forecasts but even without that detail, most of the increase has come on the industrial control side, driven by the combination of Stuxnet and better cyber security awareness among operations teams. 4

6 Section 8 TABLE OF CONTENTS Section Executive Summary Introduction Market Landscape What Has Changed in a Year Key Technologies for Smart Grid Cyber Security Market Forecast... 4 Section Market Issues Introduction Smart Grid Market Segments Smart Grid Security Overview Transmission Upgrades Description Market Drivers Overview of Security Issues Substation Automation Description Market Drivers Overview of Security Issues Distribution Automation Description Market Drivers Overview of Security Issues Advanced Metering Infrastructure Description Market Drivers Overview of Security Issues Electric Vehicle Management Systems Description Market Drivers Overview of Security Issues Approach to Assessing Smart Grid Cyber Security Risks Important Government and Regulatory Standards IT Security: ISO27002: ISO 27002:2005 Control Categories ICS Security: NIST Smart Grid Security: NERC CIP Standards Defense-in-Depth: U.S. CSSP Recommended Practices Data Privacy: NISTIR 7628 Volume Lemnos German Smart Metering Protection Profile Section Technology Issues Introduction SCADA and Industrial Control Risks Introduction

7 3.2.2 Control Centers Human-Machine Interfaces Telecommunications Device Controllers Other Transmission, Distribution, and Substation Risks Introduction Communications and Operations Risk Access Control Asset Risks Physical and Environment Advanced Metering Infrastructure Risks Privacy and Data Protection Risks Communications and Operations Risks Access Control Risks Asset Risks Physical and Environment Risks Electric Vehicle Charging Systems Risks Privacy and Data Protection Communications and Operations Access Control Asset Risks Physical and Environment Human Resources Risks Security Awareness Program Social Engineering Attacks Employee Separations Third-Party/Subcontractor Risks Governance and Regulatory Compliance Issues Security Organizational Issues for Smart Meters Security Assessment and Policies Change Management Third-Party Service Provider Risks AMI Governance and Regulatory Compliance Issues EV Governance and Regulatory Compliance Issues Intellectual Property Risks Security Incident Response Readiness Issues Reputation Risk Investigations and Cyber Forensics Third-Party Managed Services Business Continuity Smart Grid Security Recap of Key Opportunities Top Threats that Are Insufficiently Mitigated Section Key Industry Players Introduction AlertEnterprise AlienVault Atos S.A Byres Security Inc. (Tofino) Cisco CoreTrace Computer Sciences Corporation

8 4.9 Digital Bond Inc Echelon Corporation Elster Group Energy Sector Security Consortium Inc EnerNex GE Energy Green Hills Software IBM Industrial Defender Inc InfoLawGroup LLP Infrax Systems Innominate Security Technologies AG Itron Inc Landis+Gyr McAfee Inc Mocana Corporation N-Dimension Solutions NitroSecurity Inc OSIsoft Revere Security RSA, the Security Division of EMC Corporation SAIC Schweitzer Engineering Labs Inc Sensus Sophos Ltd Sourcefire Inc Symantec Corporation Trilliant Incorporated Ventyx Verizon Waterfall Security Solutions Ltd Wurldtech Security Technologies Inc Section Market Forecasts Introduction Most Promising Smart Grid Risks to Address Market Forecast Methodology Total Smart Grid Security Market by Region Annual Revenue by Region Cumulative Revenue by Region Year-on-Year Market Change, Percentage Total Smart Grid Security Market by Segment Annual Revenue by Region Cumulative Revenue by Region Year-on-Year Market Change, Percentage Total Smart Grid Security Market by ICS or IT Annual Revenue by ICS or IT Cumulative Revenue by Segment Year-on-Year Market Change, Percentage Market Forecasts: North America North America Forecast by Segment The United States versus Canada Market Forecasts: Latin America

9 5.8 Market Forecasts: Western Europe Market Forecasts: Eastern Europe Market Forecasts: China Market Forecasts: Asia Pacific except China Market Forecasts: the Middle East & Africa Summary of Professional Services Opportunities Section Company Directory Section Acronym and Abbreviation List Section Table of Contents Section Table of Charts and Figures Section Scope of Study Sources and Methodology Notes

10 Section 9 TABLE OF CHARTS AND FIGURES Chart 1.1 Smart Grid Cyber Security Revenue by Region, World Markets: Chart 5.1 Smart Grid Cyber Security Revenue by Region, World Markets: Chart 5.2 Cumulative Smart Grid Cyber Security Revenue by Region, World Markets: Chart 5.3 Smart Grid Cyber Security Revenue Change by Region, World Markets: Chart 5.4 Smart Grid Cyber Security Revenue by Segment, World Markets: Chart 5.5 Cumulative Smart Grid Cyber Security Revenue by Segment, World Markets: Chart 5.6 Smart Grid Cyber Security Revenue Growth by Segment, World Markets: Chart 5.7 Smart Grid Cyber Security Revenue by IT and ICS, World Markets: Chart 5.8 Cumulative Smart Grid Cyber Security Revenue by IT or ICS, World Markets: Chart 5.9 Smart Grid Cyber Security Revenue Growth by IT or ICS, World Markets: Chart 5.10 Smart Grid Cyber Security Revenue by Segment, North America: Chart 5.11 Smart Grid Cyber Security Revenue, United States and Canada: Chart 5.12 Smart Grid Cyber Security Revenue by Segment, Latin America: Chart 5.13 Smart Grid Cyber Security Revenue by Segment, Western Europe: Chart 5.14 Smart Grid Cyber Security Revenue by Segment, Eastern Europe: Chart 5.15 Smart Grid Cyber Security Revenue by Segment, China: Chart 5.16 Smart Grid Cyber Security Revenue by Segment, Asia Pacific except China: Chart 5.17 Smart Grid Cyber Security Revenue by Segment, the Middle East & Africa: Figure 3.1 SCADA System General Layout Table 2.1 Comparison of IT and ICS Security Requirements Table 5.1 Allocation of Revenue to ICS or IT by Segment

11 Section 10 SCOPE OF STUDY This report surveys cyber security issues for smart grids to determine which security issues present the most viable opportunities for smart grid cyber security vendors. Pike Research interviewed a wide variety of stakeholders, including utilities, security vendors, systems integrators, component manufacturers, and well-known subject matter experts. We diligently compared the current state of the smart grid industry to appropriate baselines for the topic, including: ISO 27002:2005, NIST , U.S. DHS CSSP Defensein-Depth, NISTIR 7628 Volume 2 for Data Privacy, and NERC CIP standards. While it is true that these are all U.S. standards, it remains challenging to find standards from anywhere else in the world. However, as noted in the report, the German government has produced a Protection Profile for smart metering data, with hopes that it will be adopted throughout Europe. Regardless, the number and variety of research inputs, combined with these security standards, yields a sturdier set of conclusions and filters out any personal agendas that may have been inserted into the research inputs. Pike Research segments the smart grid into five application areas: transmission upgrades, substation automation, distribution automation, smart metering, and EV management. Typically, the first three have large ICS components, while the final two have large IT components. That is reflected in our comments throughout the report and in the assumptions used in generating our forecasts. This report draws heavily on other Pike Research reports and forecasts concerning smart grid technology, AMI, DA, substation automation, and EV markets. Smart grid cyber security exists only because those other markets generate products and services that must be secured. Cyber security is an extremely broad market with hundreds of established providers and countless startups. To examine every possible security provider in the smart meter market would have produced a report of incredible length. Therefore, Pike Research surveyed a representative population of stakeholders to obtain as complete as possible a picture of smart meter security, while limiting the report to a usable size. To do this, we selected only a few stakeholders from each area of the control network environment. Secondary research, mainly Internet searching and conference attendance, is used mainly as triangulation to validate conclusions from primary research, although it does, from time to time, yield valuable insights. Note that the inclusion of any company in this report does not constitute an endorsement by Pike Research. Likewise, the omission of any company from this report should not imply that Pike Research perceives any weakness in that company s products or services. We simply had to select a representative population and work with the data from those interviews and other research. 95

12 SOURCES AND METHODOLOGY Pike Research s industry analysts utilize a variety of research sources in preparing Research Reports. The key component of Pike Research s analysis is primary research gained from phone and in-person interviews with industry leaders including executives, engineers, and marketing professionals. Analysts are diligent in ensuring that they speak with representatives from every part of the value chain, including but not limited to technology companies, utilities and other service providers, industry associations, government agencies, and the investment community. Additional analysis includes secondary research conducted by Pike Research s analysts and the firm s staff of research assistants. Where applicable, all secondary research sources are appropriately cited within this report. These primary and secondary research sources, combined with the analyst s industry expertise, are synthesized into the qualitative and quantitative analysis presented in Pike Research s reports. Great care is taken in making sure that all analysis is well-supported by facts, but where the facts are unknown and assumptions must be made, analysts document their assumptions and are prepared to explain their methodology, both within the body of a report and in direct conversations with clients. Pike Research is an independent market research firm whose goal is to present an objective, unbiased view of market opportunities within its coverage areas. The firm is not beholden to any special interests and is thus able to offer clear, actionable advice to help clients succeed in the industry, unfettered by technology hype, political agendas, or emotional factors that are inherent in cleantech markets. NOTES CAGR refers to compound average annual growth rate, using the formula: CAGR = (End Year Value Start Year Value) (1/steps) 1. CAGRs presented in the tables are for the entire timeframe in the title. Where data for fewer years are given, the CAGR is for the range presented. Where relevant, CAGRs for shorter timeframes may be given as well. Figures are based on the best estimates available at the time of calculation. Annual revenues, shipments, and sales are based on end-of-year figures unless otherwise noted. All values are expressed in year 2011 U.S. dollars unless otherwise noted. Percentages may not add up to 100 due to rounding. 96

13 Published 4Q Pike Research LLC 1320 Pearl Street, Suite 300 Boulder, CO USA Tel: This publication is provided by Pike Research LLC ( Pike ). This publication may be used only as expressly permitted by license from Pike and may not otherwise be reproduced, recorded, photocopied, distributed, displayed, modified, extracted, accessed or used without the express written permission of Pike. Notwithstanding the foregoing, Pike makes no claim to any Government data and other data obtained from public sources found in this publication (whether or not the owners of such data are noted in this publication). If you do not have a license from Pike covering this publication, please refrain from accessing or using this publication. Please contact Pike to obtain a license to this publication. 97