POWER August 2017 - 46

CYBERSECURITY
Stepping Up Cybersecurity: Power
Producers Move Ahead
The energy sector has been hit with almost one-third of the cyberattacks against
U.S. industrial facilities in recent years. It is among the top issues, along
with reliability, environmental regulations, and aging infrastructure, facing
power plant operators. New technologies and processes are available
to help fight the battle.
Tom McDonnell
T
he cyberattack on Ukraine's power grid
in December 2016 brought the industry's
vulnerabilities into sharp relief.
For decades, the more familiar territory of
physical security threats had dominated the
conversation. Just before Christmas, the grid
attack cut power to 103 cities and towns,
leaving nearly 200,000 Ukrainians without
power for several hours. The global utility industry
felt the ripple effects, and the urgency
to address and attempt to prevent cybersecurity
threats mounted.
For years, cybersecurity trailed behind
reliability, environmental regulations, and
aging infrastructure in the list of issues
confronting power producers. However,
cybersecurity moved firmly into the No. 2
spot in 2016, and recent news of hackers
targeting U.S. nuclear power plants proves
the threat is very real.
In fact, U.S. industrial control systems
were hit by cyberattacks at least 245 times
during a 12-month period between 2014 and
2015, according to the U.S. Industrial Control
Systems Cyber Emergency Response
Team. While every industry is prone to attack,
the energy sector led all other industry
verticals with almost one-third of the attacks.
Power is a fundamental resource that
drives civilization. It is critical to economic
and military defense infrastructure; therefore,
it's an obvious target for security threats. For
that reason, power generators are actively
working to improve their practices and more
effectively navigate the cybersecurity landscape.
This report looks at today's challenges,
and the way power producers can address
cybersecurity concerns and regulations more
efficiently and effectively.
Challenges for Bulk Electrical
Systems
When it comes to acting on relevant regulatory
standards, power producers have to take
a holistic approach. The positive news is that,
46
1. Keeping the lights on also means keeping a plant's operations safe.
As power producers work to achieve connected operations due to the rise of intelligent devices
and smart equipment, they should continue to take a holistic approach to security standards.
Source: Shutterstock
in general, power producers are ahead of the
curve when it comes to cybersecurity compared
to other industrial companies. Take the
recent presidential executive order designed
to strengthen the cybersecurity of federal
networks and critical infrastructure. It calls
for an assessment of cyber readiness and vulnerabilities.
The electrical industry is already
doing this in order to comply with industry
regulations and standards, including North
American Electric Reliability Corp. Critical
Infrastructure Protection (NERC CIP) standards
(see sidebar), the Cybersecurity Act of
2015, and National Institute of Standards and
Technology (NIST) standards.
People rely on power producers to provide
economic security, environmental stability,
and health infrastructure service in their daily
lives. Given the potential for national security
threats, it makes sense that these standards
are crucial.
The integration of renewable generating
assets, propagation of distributed generation,
and need for an integrated generation infrastructure
has led to multiple progressions in
www.powermag.com
the industry. The first is convergence of information
technology (IT) and operational
technology (OT) systems for greater collaboration
and plant-wide efficiency (Figure
1). The second industry shift is the increase
of intelligent devices and smart equipment,
which serve as the foundation of a connected
power plant (see " The Future Is Now: Connected
Power Plants Are Here " in the April
2017 issue).
As power producers work to implement
IT/OT convergence and intelligent devices,
they must continue to keep cybersecurity
threats top-of-mind. The electric power industry,
for instance, follows threat mitigation
methods that focus on areas such as preparation,
prevention, response, and recovery.
It's no secret that the goal for every facility
is to manage risk properly, which might
include system upgrades. Still, according to
the Edison Electric Institute, there are tens of
thousands of power plants in North America,
and they cannot be protected from all threats
100% of the time (Figure 2).
In fact, not all producers will be able to
POWER | August 2017

http://www.powermag.com

POWER August 2017

Table of Contents for the Digital Edition of POWER August 2017