Technology Corridor

Cyber and Physical Security:

Although NERC and other agencies are helping out, utilities still face internal obstacles.

With the terrorism threat level elevated ahead of the 2004 elections, utilities find themselves in an increasingly familiar position. The industry-targeted by Kalid Sheik Mohammad during the early planning of the attacks of Sept. 11, 2001, and which fell victim to a blackout caused by its own deficiencies last August-has refocused its efforts on physical and cyber security.

This new focus has revealed that despite improved levels of cooperation with the government and other private industries, coordination issues continue to dog efforts at improving utility cyber and physical security.

The challenge of meeting threats from outside the utility is complicated by each utility's own internal culture, and the sometimes adversarial relationship between the information technology (IT) staff and the operations staff.

"The IT organization owns cyber-security," explains Joe Weiss, executive consultant at KEMA. "They have the expertise about cyber. They have the funding to do something about cyber. There's only one problem: They have no responsibility or accountability for any control systems." These systems lie within the territory of the operations department, which Weiss says lacks knowledge about security, and "generally doesn't like IT at all."