Reflections 03.03.2019
AMI data security is an essential part of a reliable smart grid
Harri Valkonen, Head of Product Management, Aidon Oy:
The power grid is one part of the infrastructure that’s critical to a functional society, and with digitalization, the significance of the smart grid continues to grow. This makes the grid a target for wrongdoers. Operating a smart grid requires data security to cover all areas of the metering infrastructure. What does data security mean for an AMI (Advanced Metering Infra) that delivers great amounts of detailed data? What can DSOs do to make sure that all data is collected, transferred, stored and used securely?
Business operations run smoothly when relevant information is reliable, transferable and readily available to appropriate persons. Therefore, strong data security is vital for businesses and society. For DSOs, it’s essential that the data from the metering infrastructure is secured. As a developer of AMI solutions, we at Aidon bear our part of the responsibility to build and sustain strong data security.
AMI data security is much more than an IT solution with firewalls and encryptions, because in AMI, data security must cover everything from smart meters to the head-end system and DSO’s business systems. So, what does data security encompass? Discussions about the topic often involve the abbreviation CIA. The letters stand for confidentiality, integrity and availability which describe the main objectives of data security:
1. Confidentiality of information
Confidentiality of information refers to data protection and data privacy. Data must be protected from unauthorised use, which means it must only be available to those who have been authorised to use it. Above all, confidentiality of information is related to the protection of privacy: the collection of more and more precise time series enables very detailed monitoring of an individual consumer of energy. Everyone handling private persons’ information must agree to non-disclosure.
Certain safeguards can be applied in analysing consumption of energy and the condition and load of the grid. These safeguards are called minimization, pseudonymization and anonymization. Data minimization means that only data relevant to the subject of analysis is gathered. Pseudonymization, then, refers to a procedure where information such as the identifier, address and coordinates of a measuring point, or user data from the head-end system, are converted into pseudo-information so that the data cannot be linked to any individual. Finally, anonymization refers to a procedure where data is treated in a way that makes it impossible to identify an individual person based on the data. Identification must be prevented permanently: it must be impossible for third parties to convert the data back to an identifiable form.
2. Integrity of information
Integrity of information means that data must remain immutable during handling, archiving and transfer. Data can’t be lost either. It must be possible to confirm the origin of the data, and reading values, for instance, must be traceable. Malfunctions in digital data transfer may cause errors which affect the integrity of information. For example, malicious tampering of consumption data can be a risk. Therefore, mechanisms for preventing and detecting any tampering must be in place.
3. Availability of information
Availability of information refers to both availability and usability of information. Information must be readily available to authorised parties. A power cut or system failure, for example, can cause a delay in availability. A denial-of-service (DoS) attack, on the other hand, can cause a forced shutdown of the system, during which data is not available for use. Moreover, data archiving and the availability of archived data are essential to the availability of information.
How the goals are met
Collecting data about the distribution and consumption of energy and the secure transfer of this data to authorised persons are at the core of Aidon’s business. Our advanced data security solutions are an essential part of a reliable metering infrastructure, but technical solutions alone are never enough: human behaviour, processes and other administrative controls also play an important role.
In Nordic societies, data security threats like terrorism or war are less typical than casual negligence and carelessness. In today’s operational environment, risks such as weak passwords kept carelessly, computers left unlocked, opening doors to unidentified people, or even plugging a foreign memory stick in to one’s own computer out of sheer curiosity are more likely than massive attacks aimed at paralysing your business or the grid. Contrary to malicious operations like DoS attacks, jeopardising data security through an organisation’s internal actions rarely ends up in headlines. A strong IT system and system users who are aware of their responsibilities help to prevent cyberattacks and protect the whole energy distribution chain.
