16
CHAPTER 11 Social Networking and the Smart Grid INFORMATION IN THIS CHAPTER The Smart Grid Gets Social Social Networking Threats Smart Grid Social Networking Security Checklist With Facebook reaching the level of the second most visited site on the Internet, it was a foregone conclusion that the smart grid would find a home on social net- working Web sites. 1 Ranging from Twitter.com to Blogger.com, the smart grid is already leveraging benefits of social networking. In this chapter, we will take a look at how smart grid technologies have integrated with social networking sites, as well as discuss any associated security risks. THE SMART GRID GETS SOCIAL The push for using social networking in the smart grid comes from several factors. One of the goals of smart grids is to keep customers constantly informed of how much energy they are using. With more and more people using social net- working services, social networking will provide a medium that customers are comfortable with. There are also business drivers for utilizing popular social net- working sites. Marketing departments for technology vendors will be able to advertise broad functionality support and utility companies will be able to adver- tise their use of social networking. By far, Twitter and Facebook have become the social networking sites of choice amongst smart grid technologies. Facebook provides a massive user base while also allowing for custom application development, while Twitter provides the perfect platform for micro updates. Let us now evaluate some of the current uses of both Twitter and Facebook by smart grid technologies. Twitter For the three of you reading this book who are unaware of what Twitter is, here is how it present itself to the world: Twitter is a real-time information network powered by people all around the world that lets you share and discover whats happening now. 2 A Guide to Kernel Exploitation. DOI: 10.1016/B978-1-59749-570-7.00011-X © 2011 by Elsevier Inc. All rights reserved. 195

Securing the Smart Grid || Social Networking and the Smart Grid

  • Upload
    tony

  • View
    228

  • Download
    0

Embed Size (px)

Citation preview

Page 1: Securing the Smart Grid || Social Networking and the Smart Grid

CHAPTER

11Social Networking andthe Smart Grid

INFORMATION IN THIS CHAPTER

• The Smart Grid Gets Social

• Social Networking Threats

• Smart Grid Social Networking Security Checklist

With Facebook reaching the level of the second most visited site on the Internet,it was a foregone conclusion that the smart grid would find a home on social net-working Web sites.1 Ranging from Twitter.com to Blogger.com, the smart grid isalready leveraging benefits of social networking. In this chapter, we will take alook at how smart grid technologies have integrated with social networking sites,as well as discuss any associated security risks.

THE SMART GRID GETS SOCIALThe push for using social networking in the smart grid comes from severalfactors. One of the goals of smart grids is to keep customers constantly informedof how much energy they are using. With more and more people using social net-working services, social networking will provide a medium that customers arecomfortable with. There are also business drivers for utilizing popular social net-working sites. Marketing departments for technology vendors will be able toadvertise broad functionality support and utility companies will be able to adver-tise their use of social networking.

By far, Twitter and Facebook have become the social networking sites ofchoice amongst smart grid technologies. Facebook provides a massive user basewhile also allowing for custom application development, while Twitter providesthe perfect platform for micro updates. Let us now evaluate some of the currentuses of both Twitter and Facebook by smart grid technologies.

TwitterFor the three of you reading this book who are unaware of what Twitter is, here ishow it present itself to the world:

Twitter is a real-time information network powered by people all around theworld that lets you share and discover what’s happening now.2

A Guide to Kernel Exploitation. DOI: 10.1016/B978-1-59749-570-7.00011-X© 2011 by Elsevier Inc. All rights reserved.

195

Page 2: Securing the Smart Grid || Social Networking and the Smart Grid

Twitter is a micro-blogging Web site that allows users to “tweet” messages ofup to 140 characters at a time. Tweets can be made from nearly any type ofdevice that is connected to the Internet via countless client applications or directlyvia Twitter’s Web site. Users of Twitter can follow specific individuals, organiza-tions, groups, or search for specific terms within tweets. Hash tags (#) are used toassociate tweets with specific events. For example, #syngress is the hash tag forthe publisher of this book.

Part of the reason for Twitter’s success has been the ability for its users tofollow events in real time via the information posted by other users. Such real-time information sharing makes Twitter a perfect tool for smart grid technologies.

Tweeting Energy UsageAt the time of writing this chapter, a simple Google query of “site: twitter.comkWh usage” produced over 128 unique results. I am sure that by the time you arereading this book that number will significantly increase. Let’s take a look atsome of the individuals and businesses who are utilizing Twitter to broadcast theirenergy consumption.

Andrew Jones, Managing Director of Alquist Consulting Ltd, has decided toutilize Twitter to demonstrate his organization’s commitment to reducing their car-bon footprint. Via their Twitter page, located at http://twitter.com/AlquistARJ,individuals can monitor Alquist’s buildings’ energy usage. Unlike many otherswho post tweets about energy consumption in kWh, Alquist’s Twitter feed pro-vides usage data based on costs. Alquist’s tweets also take the consumption dataavailable via the tweets to the next level by providing costs data via graphicalrepresentations posted to TwitPic.com. Figure 11.1 is a sample of Alquist’s gra-phical representation of their energy consumption data.

FIGURE 11.1

Alquist’s energy consumption data in graph form.

196 CHAPTER 11 Social Networking and the Smart Grid

Page 3: Securing the Smart Grid || Social Networking and the Smart Grid

Andy Stanford-Clark of IBM has utilized Twitter to provide real-timeinformation on his home’s energy usage. Beyond simply tweeting whether or notAndy has turned his outside lights on or off, his home posts other energy-relatedinformation such as the current electric meter reading, as shown below in Figure11.2. But why stop at simply posting information? Andy certainly did not.Through custom software, Andy can actually turn the lights on or off throughissuing commands online.

Andy’s particular setup is more advanced than other smart grid social network-ing solutions, but provides a quick glimpse into the future of social networkingand the smart grid. Simpler, more user-friendly solutions are currently availableto the masses that allow them to tweet their energy usage. For more informa-tion, you can visit Andy’s Web site located at http://stanford-clark.com/andy_house.html.

FIGURE 11.2

Andy Stanford-Clark’s home Twitter feed.

The Smart Grid Gets Social 197

Page 4: Securing the Smart Grid || Social Networking and the Smart Grid

Tweet-a-WattOne of these solutions is called the “Tweet-a-Watt,” shown in Figure 11.3.Although Tweet-a-Watts currently require some hardware hacking, they are rela-tively simple to build and set up. A Tweet-a-Watt consists of a P3 International“Kill-a-Watt” device, modified with XBee wireless adapters. The XBee wirelessadapters utilize the Zigbee wireless technology and require the receiver to beplugged into an Internet-connected device. The XBee transmitter is connected tothe Kill-a-Watt and sends energy usage data, in Kilowatt-hour, to the receiver.The receiver then uses the Internet-connected device to tweet the energy consump-tion information to Twitter.

NOTEYou can purchase a Do-It-Yourself Tweet-a-Watt kit from: www.adafruit.com/index.php?main_page=product_info&cPath=32&products_id=143&zenid=6d1306727167af57a11c948993e0bedc. Note that a Kill-a-Watt is not included in the kit. Kill-a-Watts can befound at your local hardware store or online at your favorite electronics store.

Not everyone is keen on the idea of the Tweet-a-Watt. Graham Winfrey ofThe Business Insider included the Tweet-a-Watt in his “Ten Dumbest Green

FIGURE 11.3

P3 International’s Kill-a-Watt.Courtesy of GadgetGrid.com

198 CHAPTER 11 Social Networking and the Smart Grid

Page 5: Securing the Smart Grid || Social Networking and the Smart Grid

Gadgets”3 list in December 2009. Winfrey does not elaborate on why he includedthe device in his list, but alludes to the fact that it is simply a way to brag aboutyour green living. Perhaps he should have mentioned the privacy aspects of tweet-ing your energy consumption.

Smart Meter and Broadband IntegrationIn deregulated energy markets, consumers can choose from multiple utility compa-nies for their energy needs. Usually, customers will choose their energy providerbased on pricing and reliability. However, some companies are trying to use popu-lar trends to compete in the energy market. One such utility company in Germany,Yello Strom (www.yellostrom.de/), has developed and sell its own smart meterthat utilizes the consumer’s home broadband connection.4 This has allowed YelloStrom to develop consumer-centric applications, such as their Twitter application.

Essentially, the application works by creating a Twitter account for the smartmeter. Then on a periodic basis (for example, every 10 minutes), the smart metertweets the energy usage via the consumer’s home broadband connection.4 Mostutility companies will send the data to the back office for processing first beforebeing sent to service providers, which can lead to a significant delay.4 Directlyconnecting the smart meter to the consumer’s broadband connection will providethe information to the consumer much quicker.

FacebookIf only three of you reading this book have not heard of Twitter, then I supposetwo of you do not know about Facebook. For those who do not know, Facebookis the Internet’s top social networking site, according to Compete.com.5 SinceMay 24, 2007, Facebook has allowed third parties to develop applications for itsWeb site that allow Facebook users to play games, share information, or eventrack energy usage.6

PICOwattTenrehte Technologies, a Rochester, New York-based startup, is one of the first todevelop a Facebook application that will allow users to remotely monitor and con-trol their energy usage. Tenrehte’s application will utilize their PICOwatt technol-ogy, which consists of consumer products poised to hit the market before theutility companies deploy smart meters to the masses.

PICOwatts, shown in Figure 11.4, are Wi-Fi-enabled smart plugs that augmentconsumer’s traditional power outlets. These smart plugs are essentially software-powered devices that provide real-time energy usage monitoring and device con-trol. Theoretically, consumers will install PICOwatts throughout their homes andaggregate the data via PICOwatt’s built-in Web server or via Tenrehte’s Facebookapplication. PICOwatt users can then determine how much energy devices areusing and decide when to turn devices on and off, in an attempt to lower theirelectric bills. At the time of writing this book, Tenrehte plans to release theirPICOwatts in April 2010 at an anticipated price of under $125.7

The Smart Grid Gets Social 199

Page 6: Securing the Smart Grid || Social Networking and the Smart Grid

NOTEYou can get a sneak peak at the monitoring and control capabilities of PICOwatts byvisiting Tenrehte’s demo Web site at http://airlock.tenrehte.com/aps/watt/PICOwatt.cgi?btnG=PICOstatus. Here, you will be able to view such information at device status, energyusage, pricing information, as well as interface with the command and control options thatwould allow device startups and shutdowns, as well as other potential event operations.

SmartSyncSmartSync, Inc, a Jackson, Mississippi-based smart grid infrastructure company, isalso utilizing social networking to provide energy usage monitoring to the masses.In a partnership announced on August 27, 2009, SmartSync and the University ofMississippi will utilize SmartSync’s Smart Meters to “reduce the power consump-tion of campus buildings while publishing real-time results for the general publicon Facebook, Twitter and RSS feeds.”8

In its press release, SmartSync stated that each building at the University ofMississippi to be equipped with SmartSync Smart Meters will have its ownFacebook profile page. These profile pages will provide interested parties withinformation such as energy consumption, complete with comparative analysis.The initial deployment of SmartSync’s Smart Meters at the University ofMississippi included 16 smart meters. Additional deployments are beingconsidered. Figure 11.5 shows the University of Mississippi’s Lyceum build-ing’s Facebook profile page, complete with daily energy consumption data andaddress.

FIGURE 11.4

Tenrehte Technologies PICOwatt.

200 CHAPTER 11 Social Networking and the Smart Grid

Page 7: Securing the Smart Grid || Social Networking and the Smart Grid

In their press release, SmartSync noted that

Once registered online at www.olemiss.edu/green, students, faculty, buildingadministrators and others will be able to access UM’s smart meter data andreceive updates on UM’s energy usage …8

As you can see by the screenshot in Figure 11.5, this information is available toanyone, not just “registered users.” You can view the University of Mississippi’sLyceum building’s Facebook profile page yourself by visiting www.facebook.com/pages/Oxford-MS/Lyceum/117754575778.

The University of Colorado has also jumped on the Facebook bandwagon bycreating a profile page for its Fiske Planetarium. This profile page, located at www.facebook.com/pages/Boulder-CO/Fiske-Planetarium/138531010808, is very similarto the University of Mississippi’s Lyceum building’s profile page. Although noinformation validating that the Fiske Planetarium utilizes SmartSync’s technologieswas available to the authors of this book, we will let you make your own decisionby comparing a screenshot of the University of Colorado’s Fiske Planetarium’sFacebook profile page, shown in Figure 11.6, to the University of Mississippi’sLyceum building’s Facebook profile page, shown in Figure 11.5.

WattsUpOther consumer-based Facebook applications exist, including Derek Foster’sWattsUp. WattsUp allows Facebook users to share their home’s energy usage

FIGURE 11.5

The University of Mississippi’s Lyceum Building’s Facebook profile page.Source: www.facebook.com/pages/Oxford-MS/Lyceum/117754575778. Shown for educational purposes.

The Smart Grid Gets Social 201

Page 8: Securing the Smart Grid || Social Networking and the Smart Grid

with other WattsUp users. Foster developed the application in order to “raiseawareness of energy consumption in the home which can have a positive impacton climate change. (The concepts driving creation of WattsUp are) social psychol-ogy elements such as peer-pressure and normative measurement betweenfriends.”9

Figure 11.7 is a screenshot of Derek’s WattsUp energy usage. Ironically, itappears as though Derek is no longer using his WattsUp application to publish hishome’s energy usage.

WattsUp was designed to use DIY KYOTO’s Wattson energy usage monitor-ing device. Wattson (Figure 11.8) consists of a transmitter and receiver (referredto by DIY KYOTO as the Display). The transmitter comes with a sensor clip thatis connected to the main cables between your home’s meter box and fuse box.Energy consumption information is then wirelessly transmitted to the receiver,which displays the information in both watts and monetary values. The receiverwill change colors depending on your usage; blue for low energy usage, purplefor average energy usage, and red for very high energy usage. Historical informa-tion, as well as the ability to send usage data to the WattsUp Facebook applica-tion, is captured via a USB connection to the receiver and DIY KYOTO’sHolmes software. More information on the Wattson is available from www.diykyoto.com/uk/wattson/about, while the WattsUp Facebook application is avail-able at www.facebook.com/apps/application.php?id=50473167243.

FIGURE 11.6

The University of Colorado’s Fiske Planetarium’s Facebook profile page.Source: www.facebook.com/pages/Boulder-CO/Fiske-Planetarium/138531010808.

Shown for educational purposes.

202 CHAPTER 11 Social Networking and the Smart Grid

Page 9: Securing the Smart Grid || Social Networking and the Smart Grid

SOCIAL NETWORKING THREATSNow that we have discussed the use of social networking sites by some of thelatest smart grid technologies, let us focus in on their associated threats. Rangingfrom simple information disclosure to the complete loss of control of a connected

FIGURE 11.7

Derek Foster’s WattsUp Facebook application.

FIGURE 11.8

DIY KYOTO’s Wattson.

Social Networking Threats 203

Page 10: Securing the Smart Grid || Social Networking and the Smart Grid

device, the use of social networking by smart grid technologies presents a widerange of threats with an equally large impact variance.

Information DisclosureAs we discussed in Chapter 2, “Threats and Impacts: Consumers,” informationdisclosure is one of the largest threats associated with the smart grid. The integra-tion of social networking sites simply increases this risk, as by their sheer nature,social networking sites were developed as a way to share information with others.Several recent social networking blunders have direct implications for smart gridtechnologies that utilize social networking.

On February 17, 2010, the Web site www.pleaserobme.com hit the blogo-sphere, opening the eyes of the masses to what the security community wasalready concerned about. Conceptualized and run by the folks at FortheHack.com,Please Rob Me aggregates Twitter information that suggests when people are nothome. Specifically, the site relies on tweets of users of the Internet phenomenaknown as Foursquare (http://foursquare.com). Foursquare allows users to let theirfriends know their current location via smart phones that post to Twitter and Face-book. Figure 11.9 provides a sample of Foursquare users whose information hasbeen captured by Please Rob Me.

Coincidently, the authors of this Web site had a similar idea to Please RobMe, but ours was specifically tailored to people who tweet their energy usageon Twitter. As an experiment, Tony purchased three Tweet-a-Watt devices forhis apartment, and Justin wrote a couple of perl scripts, utilizing Twitter’s API,that would capture Tony’s energy usage. The goal of the experiment was forJustin to be able to accurately determine when Tony was home, and when hewas not, solely based on his energy usage. To determine the outcome of theexperiment, Justin would call Tony when Justin believed that Tony was nothome. Justin would only be able to call Tony five times over the course of oneweek. Before proceeding with the experiment, Justin believed that he wouldbe 100 percent successful, or five correct out of five attempts, in determiningwhen Tony was home or not. Tony, while believing that 100 percent accuracywas not unattainable, believed that Justin would be 80 percent successful, orfour correct out of five attempts, in successfully identifying when Tony wasnot home. Justin reminded Tony that he could not alter his energy usage inan attempt to get Justin to wrongly identify when Tony was not home. Tonybegrudgingly agreed.

To accomplish the task, Tony modified his three Tweet-a-Watts to sendinformation to a local server running at his house. The server would capture theinformation from the three Tweet-a-Watts, aggregate them, and then post theinformation to Twitter in five-minute intervals. Unlike many of the previouslynoted examples of tweeting energy usage, Tony protected his apartment’sTwitter account so that only Justin’s server account could access theinformation.

204 CHAPTER 11 Social Networking and the Smart Grid

Page 11: Securing the Smart Grid || Social Networking and the Smart Grid

TIPIf you plan on jumping on the social networking/smart grid bandwagon, we recommendcreating a separate Twitter account for the dwellings or devices that you utilize. Then, justlike Tony did, protect the account to only allow those accounts you want to be able tomonitor your energy usage to do so. This will eliminate the risks we are highlighting here,as well as those that gave rise to Please Rob Me.

FIGURE 11.9

PleaseRobMe.com sample screenshot.Source: www.pleaserobme.com. Shown for educational purposes.

Social Networking Threats 205

Page 12: Securing the Smart Grid || Social Networking and the Smart Grid

Over the period of three weeks, Justin’s perl scripts captured Tony’s tweets, andmassaged the data via several simple MySQL queries. Utilizing the information,Justin was able to determine profile estimates of Tony’s energy usage. These pro-files were as follows:

• Home – Energy usage was clearly above the mean energy usage, suggestingthat Tony was using such high-energy devices as his heater, washer and dryer,dishwasher, and televisions.

• Not Home – Energy usage was clearly below the mean energy usage,suggesting that Tony was not using any high-energy devices as his heater,washer and dryer, dishwasher, or televisions.

• Sleeping – Energy usage was below the mean, but above the basement of hisusage. This profile suggested Tony was only using the “bare” essentials of hishouse, such as his heater.

• Unknown – Energy usage was close to or at the mean of Tony’s energy usage.

Simply having a reported energy usage that fell within one of the four aforemen-tioned energy profiles did not simply mean that Tony was or was not home. Rather,in developing the experiment, we decided that we should include several additionalcriteria that should be met before Justin called Tony for one of his five attempts. Thefirst additional criteria were that Tony’s energy usage should fall into the sameenergy profile for more than 30 minutes. In other words, since Tony’s setup wouldtweet his energy usage every five minutes, Justin’s scripts should only alert him aftersix sequential tweets that fell within the “Not Home” energy profile. The secondadditional criteria would be the “common sense” factor. When Justin’s scripts wouldalert him that Tony was potentially not home (meaning that Justin’s server observedat least six sequential tweets that fell within the “Not Home” energy profile), Justinwould manually review Tony’s energy usage for the past hour or so. This previousinformation was reviewed to determine if there were any anomalies in Tony’s energyusage that would suggest this was a false positive. Justin would also take into accountthe time of day and day of the week. During the day on weekdays and during thenight on weeknights, were, for obvious reasons, the most likely times when Tonywould not be home. If an alert was triggered during these times, Justin believed thelikelihood that Tony was not home was high.

As a result of the experiment, Justin was able to successfully identify whenTony was not home five out of five times, or 100 percent, of the time. Tonybelieved that Justin may have chosen the most opportune times, that is, Fridaynights and Sunday mornings, to make his five attempts, but Justin argued that amalicious person would capitalize on the same opportunities. Justin continued toargue that monitoring Tony’s energy usage simply provided supplemental infor-mation that when aggregated with common sense (or the third criteria wepreviously covered) would increase the likelihood of success.

So what exactly can be learned from the author’s experiment? Does tweetingyour energy usage make you more vulnerable to robbery or other crimes? Theauthors believe that insecurely doing so does indeed make you more vulnerable;

206 CHAPTER 11 Social Networking and the Smart Grid

Page 13: Securing the Smart Grid || Social Networking and the Smart Grid

however, the risk of someone using this information is very low. Although, thisrisk could be increased if someone like the folks at Please Rob Me integrate thistype of monitoring. All said, the authors of this book do see the benefits of tweet-ing your energy usage, but want to reinforce the tip previously mentioned in thischapter: Make sure you protect your tweets and only allow users who you wantto see this type of information to see it.

WARNINGA simple warning about using Twitter and Facebook. By default, many third-party Twitterand Facebook applications have you login using an insecure connection, such as HTTP. Ifyou use any of these third-party applications to connect to Twitter or Facebook, make sureyou are using a secure protocol to transmit login credentials or contact the application’sauthor and request this functionality. Additionally, social networking sites are not withouttheir own vulnerabilities and attackers see these sites as large targets. For more informationon securing third-party services, Chapter 9, “Third-Party Services,” describes how to mitigatethe risk with third-party services.

SMART GRID SOCIAL NETWORKING SECURITY CHECKLISTIn an effort to safeguard end users who will utilize smart grid devices thatintegrate with social networking sites such as Facebook and Twitter, the authorsof this book have developed a smart grid Social Networking Security Checklist.This checklist aims to provide end users with a set of basic controls that whenimplemented will provide end users with a security baseline. The smart gridSocial Networking Security Checklist will continue to evolve, and the authorsof this book recommend visiting this book’s companion site, located at www.fyrmassociates.com/securingthesmartgrid, to view the latest version.

Before You BeginBefore you begin your smart grid/Social Networking device implementation, youmust first understand what you attempt to gain from your implementation. Do youwant to simply remotely monitor and control your devices or do you want toshare your information with your friends, colleagues, or everyone. Determiningwhat you hope to accomplish with your implementation will guide you in imple-menting the following controls.

Basic ControlsThe smart grid Social Networking Security Checklist contains five categories forimplementing basic security controls. These categories are as follows:

1. Identity2. Authentication

Smart Grid Social Networking Security Checklist 207

Page 14: Securing the Smart Grid || Social Networking and the Smart Grid

3. Information sharing4. Networking5. Usage

Identity ControlsThe following controls should be implemented to safeguard your smart grid/socialnetworking device deployment.

• Account Name – Utilize an account name that does not easily identify you oryour device. For example, if you setup a PICOwatt device, do not name yourdevice “Justin-BedRoom-PicoWatt.” Choose something less obvious like“JsPi1.” Although this is a classic example of security through obscurity, it willprevent you from being identified by simple Google queries looking for smartgrid devices that integrate with social networking sites. Additionally, avoidusing your user e-mail address account ID. For example, if your e-mail addressis [email protected], do not name the device jtothemototheho.

• Personal Information – Do not post unnecessary information to the account.In particular, avoid entering location-based information into the account. If aFacebook page is setup for your smart device, you probably do not need toenter the city, state, or post a picture of the device.

Authentication Controls

• Secure Login – When your smart grid device connects to social networkingsites, make sure that it is utilizing a secure protocol, such as HTTPS. Awarning earlier in this chapter called out that some third-party applicationsutilize HTTP and not HTTPS to transmit your login credentials. Ensuring thatyou are utilizing a secure protocol when providing login credentials to socialnetworking sites will help protect your device’s social networking account.Additionally, ensure that the application transmits your session credentialssecurely as well. As long as your current login session is valid, your sessioncredentials, such as a session cookie, are your login credentials.

• Unique Password – In addition to the standard complexity requirements,choose a unique password for each of the social networking accounts. Avoidusing passwords that you use for other accounts, such as your e-mail account.If someone is able to compromise your e-mail account, they would then beable to access your social networking account.

• Password Sharing – Although the traditional recommendation of not sharingyour password with other persons still applies, you should also not share yourother account passwords with the social networking site. For example,Facebook allows you to enter your e-mail address and e-mail accountpassword to automatically identify friends in your e-mail account’s addressbook.

• Security Questions – Apply the same password security controls to thesecurity questions. Some social networking sites will utilize security questions,

208 CHAPTER 11 Social Networking and the Smart Grid

Page 15: Securing the Smart Grid || Social Networking and the Smart Grid

such as what is your mother’s maiden name or what is your favorite restaurant,to provide an additional layer of security or to change your “forgotten”password. The problem is that this information can usually be obtained byreading your social networking profile. By choosing complex and uniqueanswers (that are factually incorrect), you will be able to prevent someonefrom intelligently guessing the answer.

Information Sharing Controls

• Privacy – When you setup your smart grid device’s social networking profile,make sure that you set it to “private.” This will prevent anyone from viewingyour smart grid devices information updates. Once you have configured theprofile as “private,” allow only the users (or accounts) you want to be able toview your smart grid device’s information. For Facebook and Twitter, requestsmust be sent from the user account that would like to be able to view thesmart grid device’s updates.

• Third-Party Application Sharing – Avoid using any unnecessary third-partyapplications. Social networking sites highly encourage the development ofapplication add-ons. When you attempt to use these add-ons, the applicationswill try to access the information in your profile, which may make yourinformation accessible to the third party.

Networking

• Segmentation – When installing your smart grid device on your local areanetwork, segment it from the rest of your home’s network devices. This canbe done through firewall access control lists or via switch virtual local areanetworks with access control lists. Segmenting your smart grid device willhelp prevent unauthorized access to the rest of your devices in the case thatsmart grid device is compromised.

Usage

• Browsing – When you are logged into the social networking account, avoidbrowsing to other social networking profiles or Web sites. Additionally,explicitly log out and close the browser before browsing to other Web pages.Restricting your browsing habits while logged in will help avoid cross-siterequest forgery attacks against your device’s social networking profile.

SUMMARY

Social networking sites like Facebook and Twitter have forever changed the waythat we use the Internet. Ubiquitous access to social networking sites has also for-ever changed the way that we utilize social networking sites. The marriagebetween smart grid devices and social networking sites is one that does make

Summary 209

Page 16: Securing the Smart Grid || Social Networking and the Smart Grid

sense. However, precaution and constant monitoring of new and emerging threatsmust take precedence to ensure their marriage is a healthy one.

As with using social networking sites for the primary purpose, sharing infor-mation with other people, maintaining much of privacy and security is dependenton the end user. Utilizing smart grid devices that integrate with social networkingsites will require additional maintenance and vigilance of end users in order tolimit the risk associated with using these devices and services.

The risks associated with the smart grid and social networking sites are conti-nually evolving. However, implementing basic controls will provide end userswith a baseline security level. The authors of this book believe that the aforemen-tioned smart grid Social Networking Security Checklist will enable end users toimplement these basic controls and attain a baseline security level. However, asnew functionality is added to smart grid devices and social networking sites, newthreats and attacks will undoubtedly be introduced. Thus, the end user mustremain vigilant by understanding these new threats and attacks and implementingthe appropriate controls.

Endnotes1. Alexa Internet, Inc. Alexa Top 500 Global Sites [document on the Internet], www.

alexa.com/topsites; 2010 [accessed 01.03.10].2. Twitter. About Us [document on the Internet], http://twitter.com/about; 2010 [accessed

01.03.10].3. Business Insider, Inc. Ten Dumbest Green Gadgets [document on the Internet], www.

businessinsider.com/the-ten-dumbest-green-gadgets-2009-12/wind-n-go-freedom-shaver-1; 2009 [accessed 01.03.10].

4. Earth2tech. The World’s Coolest Utility: Yello Strom’s Got Smart Meters That Tweet[document on the Internet], http://earth2tech.com/2009/07/02/the-worlds-coolest-utility-yello-stroms-got-smart-meters-that-tweet/; 2009 [accessed 01.03.10].

5. Compete, Inc. Social Networks: Facebook Takes Over Top Spot, Twitter Climbs [docu-ment on the Internet], http://blog.compete.com/2009/02/09/facebook-myspace-twitter-social-network/; 2009 [accessed 01.03.10].

6. TechCrunch. Facebook Launches Facebook Platform; They are the Anti-MySpace[document on the Internet], http://techcrunch.com/2007/05/24/facebook-launches-facebook-platform-they-are-the-anti-myspace/; 2007 [accessed 01.03.10].

7. CNET. Picowatt does smart grid without smart meter [document on the Internet]. CBSInteractive, http://ces.cnet.com/8301-31045_1-10429865-269.html; 2010 [accessed01.03.10].

8. SmartSync, Inc. SmartSync Partners with the University of Mississippi to Lower Cam-pus Power Consumption with Smart Meters and Social Networking tools [document onthe Internet], www.smartsynch.com/news/082709.htm; 2009 [accessed 01.03.10].

9. Windows Developer Center. Facebook Developer Toolkit [document on the Internet].Microsoft Corporation, http://msdn.microsoft.com/en-us/windows/ee384421.aspx;[accessed 01.03.10].

210 CHAPTER 11 Social Networking and the Smart Grid