Cybersecurity in the Smart Grid: Practitioners` Perspective
Meyer, J. & Apruzzese, G., Industrial Control System Security Workshop (co-located with ACSAC), 2022 Workshop
Oneliner: Elucidating the disconnection between Research and Practice.
Abstract. The Smart Grid (SG) is a cornerstone of modern society, providing the energy required to sustain billions of lives and thousands of industries. Unfortunately, as one of the most critical infrastructures of our World, the SG is an attractive target for attackers. The problem is aggravated by the increasing adoption of digitalisation, which further increases the SG’s exposure to cyberthreats. Successful exploitation of such exposure leads to entire countries being paralysed, which is an unacceptable – but ultimately inescapable – risk. This paper aims to mitigate this risk by elucidating the perspective of real practitioners on the cybersecurity of the SG. We interviewed 18 entities, operating in diverse countries in Europe and covering all domains of the SG – from energy generation, to its delivery. Our analysis highlights a stark contrast between (a) research and practice, but also between (b) public and private entities. For instance: some threats appear to be much less dangerous than what is claimed in related papers; some technological paradigms have dubious utility for practitioners, but are actively promoted by literature; finally, practitioners may either under- or over-estimate their own cybersecurity capabilities. We derive four takeaways that enable future endeavours to improve the overall cybersecurity in the SG. We conjecture that most of the problems are due to an improper communication between researchers, practitioners and regulatory bodies – which, despite sharing a common goal, tend to neglect the viewpoint of the other ‘spheres’.