Cloud computing represents a potential boon for the operators of the North American electric grid, but adapting to the change while remaining compliant with NERC’s reliability standards could be a significant challenge for utilities, a speaker from ReliabilityFirst said at SERC Reliability’s Fall Reliability and Security Seminar.
Lew Folkerth, principal reliability consultant at RF, cast the transition to cloud computing as the latest in a long line of changes. He started his presentation by showing a picture of a slide rule, jokingly asking how many in the room recognized it, before juxtaposing it with a picture of a cloud data center. Both were intended to “help solve problems,” he said, but the data center would “help solve problems just a little bit faster.”
“We [deal with] this stuff all the time. We change daily. But if we don’t manage it, it bites us, right? So, what we’re doing now is all about managing the change in the computing paradigm that we’re seeing coming at us like a freight train,” Folkerth said.
Utilities in the electric industry are moving to adopt cloud services with growing speed, Folkerth said — but the choice sometimes can seem like it is out of operators’ hands. A major driving force is the migration of “essential services that we’re used to having on premise,” such as multifactor authentication and security applications like anomalous traffic detection and end-point detection and response. Folkerth said NERC’s recently approved requirements for internal network security monitoring are an example of a service “that’s probably best done in a cloud environment.”
The move to the cloud can create unforeseen problems regarding compliance with NERC’s Critical Infrastructure Protection (CIP) standards. For instance, Folkerth pointed out, cyber systems classified as “low impact” under NERC’s standards — meaning they pose a lower risk of disrupting grid operations if compromised — are not required to have physical control centers on-site. However, this requirement changes if a system is reclassified to “medium impact,” which may be as simple as expanding a solar farm to 1500 MW.
“The question is, from the ERO perspective, do we make them backtrack? Build a physical control center with on-site computers so that they can be fully compliant … at significant cost? And how much are we actually adding to the reliability of the [grid] by making them do that?” Folkerth said.
Another challenge with the cloud transition is ensuring compliance when the service providers themselves are not subject to the CIP standards. Cloud operators such as Microsoft and Amazon serve many clients, Folkerth pointed out, and store their data in multiple locations — which may not mesh well with NERC’s security expectations. Expecting them to “let each and every utility audit their systems” is not realistic.
Reliability is another concern. Folkerth said some major cloud providers advertise 99% availability, which sounds “pretty darn good” — except that “99% means 3.65 days per year you don’t have service.” One solution is to have multiple services so that if one fails a utility can switch to another. This approach still could introduce an unpredictable level of latency.
Folkerth encouraged seminar attendees to follow the work of NERC’s standard drafting teams developing the requirements related to cloud services and participate if possible.
“We like fresh voices,” he said.
