The World Anti-Doping Agency said on Tuesday that a group of Russian hackers known variously as Tsar Team and Fancy Bear broke into a database holding confidential medical data of Olympic athletes and posted some of it on the internet.
The breach is the latest is a string of hacks targeting everything from Minecraft players to the Internal Revenue Service and even a U.S. presidential contender. But few of them could have larger and longer-lasting implications than an attack on electricity—the lifeblood of the world—and the infrastructure that distributes it to homes and businesses. “One of our biggest challenges in the power industry is the threat cyberattacks could pose to power plants and grid operations,” explains Rob Garry, executive chief engineer for product cybersecurity at GE Power. “We are using the latest technologies with customers today, but in parallel we need to develop new, differentiated ways to detect and defend against cyber risks.”
Garry and his colleagues at GE Global Research (GRC) are taking the lifeblood metaphor further. The human body has shown an incredible resiliency to fight pathogens or toxins in a coordinated response that often involves multiple organs. They want to learn from the human body’s ability to detect, defeat and deter threats and replicate its methods to protect industrial control systems in power networks and the industry in general.
“How the human body fights off pathogens and other infections is a natural marvel,” says GE’s Lalit K. Mestha. “It automatically detects and triggers a self-defense mechanism to fight it. We’re trying to replicate similar kind of automatic detection and trigger functions through feedback within our power systems.” Top and above images credit: Getty Images
Few people have a better view of the problem. Consider that GE’s power generation equipment is producing about a third of the world’s electricity. It’s also one of the reasons why the Department of Energy recently gave funding to a team of scientists at the GRC to develop and demonstrate a next-generation cybersecurity technology to help protect critical power-generation assets. GE’s project is one of 12 awards totaling $34 million of DOE investment.
Lalit K. Mestha, the GRC controls principal engineer who is leading the project with the DOE, has a background in biomedical engineering—he studied how endocrine, respiratory, circulatory and other systems interact. This allows him to see cybersecurity in biological terms. “Whether it’s a complex machine or a person, each has very sophisticated systems to control its function and operation,” Mestha said. “How the human body fights off pathogens and other infections is a natural marvel. It automatically detects and triggers a self-defense mechanism to fight it. We’re trying to replicate similar kind of automatic detection and trigger functions through feedback within our power systems.”
When a flu virus enters the body, Mestha says, a big part of what enables the immune system to react is the body’s ability to sense that something is wrong. “In GE machines, we use sensors to help detect or forecast a potential cyber disruption,” he says. “It starts with detecting an anomaly or anomalies in a machine’s operation. But we want to take things one step further by using controls technology to automatically enable the machine to adjust its operation in response to an attack just like the human body does to pathogen attacks or infections.”
Mestha’s colleague Justin John, who runs the GRC’s Controls & Optimization Lab, is assembling a team for building digital replicas of machines and even plants, their “digital twins,” and give them an automated detection and self-defense capability. “The general idea is to use our digital model of plant operations to detect anomalies that could indicate a cyber disruption or attack is underway,” he said. “If one is detected, the control system we design in the plant using sensors and complex algorithms would automatically adjust its operation to reduce risk of harm to the asset and keep the system running.”