MultiSpeak® defines interfaces that are used by electric utilities to integrate enterprise applications. It consists of a data model and associated service definition contracts. The kinds of data that are passed include all data pertaining to the utility enterprise including, but not limited to, metering information, customer information, and even payment information in some instances. Confidentiality and integrity are important considerations around such information. Some MultiSpeak messages trigger actions in the distribution grid, such as engaging or disengaging breakers. Interference with such messages can threaten life and property, thus requiring authenticity and accountability.
In general, external and internal threats may attempt to modify commands and/or inject entirely new commands, modify data being exchanged, or get access to sensitive data. This could result in loss of life or limb, widespread or targeted power outages, various operational issues resulting from incorrect information being stored in MDM/CIS, breach of customers’ personally identifiable information, financial losses for utilities, reputation damage for utilities, and regulatory/legal issues.
The MultiSpeak Initiative has developed a security standard to help address these threats, which is applicable to any web services version of MultiSpeak (Version 3.0, 4.x, or 5.0). The security standard is available to MultiSpeak members. The goal of providing this security standard is to help provide confidence that messages are authentic and unmodified, and are available only to those authorized to read them. When implemented, these security recommendations will help reduce the likelihood of external or internal threats being able to carry out attacks that can have the impacts discussed above. This will help ensure that MultiSpeak-enabled applications can fulfill utilities’ security requirements in a standard way such that they remain interoperable.
Utility staff members concerned with implementing MultiSpeak data exchanges or the utility’s security policy should carefully consider the potential security risks of MultiSpeak messaging and adopt appropriate countermeasures. It is important to emphasize that services implemented to enhance the security of MultiSpeak messages do not constitute a comprehensive approach to cyber-security. MultiSpeak interfaces, even if secured, must be implemented in the context of a comprehensive utility cybersecurity policy, including, but not limited to, good password control and key management. The MultiSpeak Initiative has also developed an implementation guidance document that provides suggested guidance to those responsible for implementing secured MultiSpeak interfaces. This document is also available to MultiSpeak members.
For more information about the MultiSpeak security standard or implementation guidance documents, interested parties should contact Tony Thomas.
