Information security is an ever-moving target. So accepted is this idea that the mantra holds that “Security is a journey, not a destination”. As each class of device has become more powerful, more connected, and the software that runs on it more flexible, it has risen above the target horizon of the cracking community. Computing power, connectivity and capability are important factors that collectively increase the business value of a device, however these factors also increase the attack surface of a device. The increasing business value of a device is also a factor in its attractiveness as a target. To an extent this is a side effect of Metcalfe’s law. So while an increased attack surface means that a device is potentially easier to attack, increased value means that it is more likely to be attacked.

Of course these phenomena are not confined to the data centre world. IT enabled, non data centre devices have long been a target of attackers. The most commonly cited example are SCADA nodes. The acronym is almost self explanatory—Supervisory Control And Data Acquisition—SCADA is a protocol that allows for the remote management of non IT devices and the collection of data from those devices. SCADA devices are to be found throughout industrial systems including petrochemical, electricity generation and distribution, and potable water and sewerage systems. SCADA networks are now well recognised as being points of vulnerability since they became IP enabled some years ago.

All that was worth covering as therein lies an important lesson. We are likely to see yet another class of devices become a lot smarter, a lot more connected, and a lot more important to the business. Electricity meters have thus far been fairly innocuous devices and certainly not ones that any Chief Security Officer would have given more than a moment’s thought to. However with the increasing focus on energy usage, linked to a drive to measure and manage a business’s emissions, those devices are about to be revolutionised. What was previously a principally electromechanical device is becoming a network enabled one with imbedded IT smarts.

This change is driven by the dual requirement for businesses to get a lot more granular in their electricity consumption monitoring, together with the potential need to enable micro generation of on-site power and the selling of that power back to the national grid. While a business’s facility may today have a single meter for the entire building, it is in future to more likely have separate metering capability for different parts of the business. That need is itself driven by the increasing desire to understand carbon emissions and to have the ability to apportion emissions to the various lines of business and business processes that comprise a company’s operations.

While smart meters are not themselves new, next generation devices will be characterised by their programmable computing power and their open network addressable interfaces. It is those characteristics plus the fact that such devices will play an active role in power management rather than simply a passive measurement role that make them a potential security risk. Indicators that electricity meters will become the network nodes of the future are to be found in the moves of major industry players. Cisco for instance, regards metering end nodes as a significant factor driving future network expansion. SAP has added electricity-metering capability to their management reporting packages. IP addressable, smart meters are appearing on the market. So while we are yet to see IP enabled toasters, we will soon see ubiquitous IP enabled power meters that help us control how much electricity the kitchen uses.

Smart meters will be programmable and will run a computing platform that falls somewhere between a mobile phone and a smart phone in terms of grunt. In order to be able to retrofit them into existing facilities the networking capabilities of smart meters will generally be wireless. As such smart meters will evolve into devices that can alter electricity supply patterns, while allowing remote, wireless updating of the rule-sets that control their behaviour. Malicious motivation is not a requirement for such devices to be attacked, they will be simply because they can be.

The vast majority of smart metering will be deployed outside of the IT department in an average business. The smelter, the assembly line, or the warehouse containing industrial refrigerators are all more likely to be a focus of energy management efforts before the data centre. Devices with imbedded IT will thus find themselves deployed in a way that creates a network of things that exist outside the general scope of the IT world.

All that means that CSO’s need to expand their scope of vigilance into yet another domain. IP enabled, smart meters will provide yet another attractive target to crackers in the future. In addition, both power companies and carbon emission regulators will require assurance that smart electricity meters have not been compromised and that there readings are thus to be trusted. Electromechanical meter tampering is already a known and relatively common criminal offence. The manufacturers of the next generation of imbedded-IT smart meter devices will need to ensure that their design specifications include a strong consideration toward the security of the device, and its network facing management interfaces. Meanwhile CSO’s will need to ensure that crackers do not gain power over their company’s power meters.