2027 Event Agenda

The power industry needs a new set of cyber-security technologies, and soon.  In fifteen years or less, experts predict that quantum computers will be able to break most of the cryptographic mechanisms currently being deployed to protect power industry operations.  The NERC Critical Infrastructure Protection (CIP) standards are responding to this threat by requiring post-quantum solutions for utility applications a decade before that.  Algorithms have been developed and published to combat this threat, but they are not “drop-in” replacements for what exists; furthermore, some have not yet been proven, and some that are presently proven may be broken by the time “Q-Day” arrives.   In addition, the Operations Technology (OT) networks in the power system are still “catching up” to the best security practices in the IT world such as role-based access and authorization.

The industry experts in this panel will discuss the measures presently being built into the Distributed Network Protocol Security Layer (DNP3-SL) and Authority Management Protocol (AMP) to prepare North America’s most popular OT monitoring and control protocol suite for the uncertainty the next decade or so will bring.  Topics to be discussed include: standardization of security policies and behaviour across mixed IP and serial networks; how the requirements for a public key infrastructure (PKI) for OT are different than they are for IT; the implementation of authorization in addition to identification and authentication; why the post-Q threat is different in OT networks than in IT and how power system devices can take advantage of that; and most importantly, how to provide “crypto-agility” so that as the quantum computing threat becomes better understood, our networks can be easily and inexpensively upgraded to support the latest counter-technologies.