Chapter 9 - Third-Party Services

Abstract

Third-party service providers play a huge role in assisting utility companies and consumers achieve their goals with smart grids. There are many different third-party services available; this chapter uses three examples to illustrate the security principles of integrating third-party services: billing, consumer interfaces, and device support. The customer billing operation, or portions of it, is outsourced to an organization that specializes in billing. The security impact of outsourcing billing is based on how many of the billing operations are outsourced. One potential advantage to use a third-party payment gateway is providing consumers the option of paying with a credit or debit card without having to be responsible for compliance with the Payment Card Industry Data Security Standard (PCI DSS). PCI DSS is a set of requirements for enhancing the security of payment account data. To provide the promised functionality of smart grids to consumers, utility companies install new technologies into consumers' homes and businesses. Furthermore, one of the most overlooked or disregarded risks associated with any organization is the threat from trusted third parties. Organizations are often left at the mercy of the third party: either accept the risk of providing remote domain administrator access or find another vendor to supply the needed service or product.