Dive Brief:

• A pair of engineers are sounding the alarm about a defect they claim exists in communications protocol used by the nation's power utilities.
• Adam Crain and Chirs Sistrunk wrote software to target the communication protocol called DNP3 used in supervisory control and data acquisition systems used to monitor the grid.
• They wrote a 20-page advisory for the Department of Homeland Security's Industrial Control Systems Cyber Emergency Response Team so vendors could know about the vulnerability.

Dive Insight: 

One glaring problem is that DNP3, although widely deployed in substations, is not subject to current cybersecurity regulations, which focus on Internet Protocol technology. “This is a systemic problem,” Mr. Crain said. “Most of the top five utilities use this software and just because a patch is available, doesn’t necessarily mean that utilities are applying them.”