Challenges in Setting up a Security Operations Team. Grid operators face many challenges when setting up security operations for the smart grid systems. The first challenge in setting up a security operations team is getting the budget. For many grid operators, the security operations team will mean a significant growth in security staff. Due to high demand in the market, the security operations staff may also require a high payment compared to other functions. Moreover, the required infrastructure and tools required also require an investment. Grid operators are in a regulated industry. In the end, budgets are determined by the regulator, also based on the risks that grid operators face. There is an increasing awareness of cyber-security risks, both at grid operators themselves, and in government. And with the introduction of the smart grid, the medium and low voltage parts of the grid will be seen more as a critical infrastructure. Hence, it is likely that more budget will be allocated to security, so that the formation of security operations teams will become possible. But even with budget available, it will be difficult to build a team with the right capabilities for the smart grids. Building a dedicated smart grid security operations team within the grid operator is difficult. Ex- cept in the case of largest grid operators, there will not be enough work to keep the team busy. For IT systems, most work for the security operations teams comes from dealing with the alerts from intrusion detection sensors, with enough incidents happening to keep the work somewhat interesting. For smart grid systems, there will be both less alerts, and less incidents. There are less alerts, because most communication is machine-to-machine. The smart grid consists of a lot of computing devices with only a small number of people operating them. So, the normal behaviour in smart grids will be very regular, and not change much over time. Intrusion detection sensors can therefore be tuned to achieve very low false positive rates, for mature products often only a handful per day. There are less real inci- dents, because there are fewer actors interested in smart grids. Strong protection at the perimeter of the smart grid systems can keep out unskilled or untargeted attacks. The skilled and motivated attackers that can penetrate, are likely associated with nation states. They will try to stay hidden, and not cause inci- dents, unless there is a crisis. In these circumstances, it will be challenging to keep a dedicated smart grid se...
