The other day a problem at a remote location caused a series of failures throughout parts of the power system that services much of the national capital region. Businesses, residences, federal agencies and even the White House were affected to one degree or another. The root cause of the problem is still under investigation, but signs currently point to this NOT being a “cyber” issue.
But of course all the news can talk about is “what if” this HAD been caused by a cyber-attack. My response – back to the radio, which doesn’t have ears – was “what would be the difference?”
Do the patients relying on life support in a hospital whose generator is about to run out of fuel care if they’re about to die because of a cyber-attack or a squirrel? Is the family who is totally unprepared for more than a few hours without electricity care if hackers or a back-hoe are the cause of their woe?
The answer of course is “No.”
Tacking “cyber” in front of everything as a way to attract attention or extract funding has been all the rage over the last few years, but there is no indication that such a tactic actually works. There are no ROI figures for what the billions in CNCI funding got us, but if recent reports are any indication, the answer is ‘not much.’ Massive breaches continue, new laws get proposed (but never become law), and everyone keeps talking about “wake up calls” that are really just the world hitting the snooze button and hoping for the best.
We have real problems in the “cyber” community, and it doesn't help when people misuse and abuse the term or the issues in order to advance an agenda that should be able to stand on its own. The question is not ‘how should we protect the grid from a cyber-attack,’ its ‘How do we improve our resilience to power outages. Period.’ You’re not going to stop a cyber-attack, just like you can’t stop careless backhoe drivers or errant ship anchors from cutting cables or squirrels from blowing transformers. S*** happens. The difference between those who get splattered and those who don’t is preparedness.