POWER June 2014 - 34

NERC CIP COMPLIANCE
When Old Systems Meet New
Realities: Adding Security
Controls to Generating Plants
Whether or not your power plant falls under the new Critical Infrastructure
Protection standards (and many more will than in the past), you should
be adding security controls. Here are some lessons learned to help you
manage that process.
Michael Toecker, PE
O
n August 14, 2003, large parts of the
Northeast and Midwest of the U.S.
and the Canadian province of Ontario
experienced one of the largest blackouts
in history: 61,000 MW of electric
load were lost, affecting the lives and businesses
of about 50 million people in the affected
areas. The U.S. and Canada created
a joint commission to study the blackout,
determine its causes, and develop recommendations
to reduce the potential for future
outages. The discovered causes of the
Northeast Blackout were condensed into
four groups (summarized from Northeast
Blackout report, pp. 18-19):
■ Failure of entities to assess and understand
the inadequacies of their power system.
■ Inadequate situational awareness leading
to lack of recognition that the system had
deteriorated.
■ Inadequate vegetation management along
transmission rights-of-way.
■ Failure of reliability organizations to
provide effective real-time diagnostic
support.
The commission made 46 recommendations
to reduce the possibility of future
outages, and the severity of ones that might
still occur. The most interesting part of this,
considering the causes identified, was that
15 recommendations directly addressed
physical and cybersecurity issues, while
neither physical nor cybersecurity was
identified as a major cause of the blackout.
The Security Working group ruled out a cyber
attack and unintentional consequences
of a currently active virus (SQL Slammer),
but it identified how technology had contributed
to the blackout due to degraded
situational awareness.
The implication here is clear: A third of
34
the Northeast Blackout recommendations
were related to improved cyber and physical
security because the investigation showed
how poor the cybersecurity of the EMS/
SCADA (energy management system/supervisory
control and data acquisition) systems
used for managing the grid was.
These recommendations led directly to
development of the North American Electric
Reliability Corp. (NERC) Urgent Action
1200 standards during 2004-2005 and
the creation of the NERC Critical Infrastructure
Protection (CIP) standards, which
we have today.
Generation was never a part of the Urgent
Action 1200 standards, but attention has shifted
over the past several years due to awareness that
generators are a crucial part of a reliable grid.
NERC CIP Version 5
The latest edition of the NERC CIP standards
should be NERC CIP Version 5. I say
" should " because the Federal Energy Regulatory
Commission has directed NERC to
make changes to the standards that will likely
result in a Version 6 in 2015. These changes
cover four major areas, one of which addresses
a lack of objective requirements for
" Low " -impact assets. The majority of North
American generating facilities that have not
had specific technical and procedural regulations
so far will fall into that category. (For
more on determining facility and asset classifications,
see " Identifying CIP Version 5
Assets in Generation " in this issue.)
Generation facilities will likely be classified
as either Medium or Low impact, based
on a set of bright-line criteria identified in
CIP-002-5. If your facility is a Medium impact
one, you'll have a set of prescriptive
requirements to follow, but a Low-impact
facility currently has a requirement for a
security policy, and not much else, until the
www.powermag.com
NERC development efforts are complete.
(Often Painful) Lessons Learned
When applying cybersecurity controls, you
are going to run into problems. Many of the
major control systems in power generation
plants are of an older variety and haven't
been updated due to a combination of cost
concerns and sufficient current reliability.
Although network perimeter strategies will
generally have little effect on older systems,
the CIP-007-5 protections are another matter
entirely.
Below I discuss two common challenges
I've encountered while involved in cybersecurity
upgrades at generation plants, so that
engineers responsible for their own upgrades
can plan appropriately to either avoid them or
understand how to resolve them.
Lesson Learned: Old Code Can Be Incompatible
with Modern Cybersecurity
Tools. The origins of many plant control systems,
especially distributed control systems
(DCSs), go back to the mid-1980s, and a lot
of the code from that era can still be found
in our systems and devices. There has simply
not been a major reason to change, as the
hardware platforms for these control systems
are controlled by the same companies that
write the code. This code persists, and can
form an impediment to some cybersecurity
controls because it was simply not designed
from a maintainability and security perspective
the way more modern code must be.
Old code affects systems in various ways
when adding cybersecurity. One way is that
older code isn't developed to take advantage
of multi-core systems. This can lead
to performance bottlenecks that inhibit the
functionality of cybersecurity controls running
alongside the DCS software and that
degrade the performance of some control
systems to an unacceptable level.
POWER | June 2014
http://www.powermag.com

POWER June 2014

Table of Contents for the Digital Edition of POWER June 2014

Contents
POWER June 2014 - Cover1
POWER June 2014 - Cover2
POWER June 2014 - Contents
POWER June 2014 - 2
POWER June 2014 - 3
POWER June 2014 - 4
POWER June 2014 - 5
POWER June 2014 - 6
POWER June 2014 - 7
POWER June 2014 - 8
POWER June 2014 - 9
POWER June 2014 - 10
POWER June 2014 - 11
POWER June 2014 - 12
POWER June 2014 - 13
POWER June 2014 - 14
POWER June 2014 - 15
POWER June 2014 - 16
POWER June 2014 - 17
POWER June 2014 - 18
POWER June 2014 - 19
POWER June 2014 - 20
POWER June 2014 - 21
POWER June 2014 - 22
POWER June 2014 - 23
POWER June 2014 - 24
POWER June 2014 - 25
POWER June 2014 - 26
POWER June 2014 - 27
POWER June 2014 - 28
POWER June 2014 - 29
POWER June 2014 - 30
POWER June 2014 - 31
POWER June 2014 - 32
POWER June 2014 - 33
POWER June 2014 - 34
POWER June 2014 - 35
POWER June 2014 - 36
POWER June 2014 - 37
POWER June 2014 - 38
POWER June 2014 - 39
POWER June 2014 - 40
POWER June 2014 - 41
POWER June 2014 - 42
POWER June 2014 - 43
POWER June 2014 - 44
POWER June 2014 - 45
POWER June 2014 - 46
POWER June 2014 - 47
POWER June 2014 - 48
POWER June 2014 - 49
POWER June 2014 - 50
POWER June 2014 - 51
POWER June 2014 - 52
POWER June 2014 - 53
POWER June 2014 - 54
POWER June 2014 - 55
POWER June 2014 - 56
POWER June 2014 - 57
POWER June 2014 - 58
POWER June 2014 - 59
POWER June 2014 - 60
POWER June 2014 - 61
POWER June 2014 - 62
POWER June 2014 - 63
POWER June 2014 - 64
POWER June 2014 - 65
POWER June 2014 - 66
POWER June 2014 - 67
POWER June 2014 - 68
POWER June 2014 - 69
POWER June 2014 - 70
POWER June 2014 - 71
POWER June 2014 - 72
POWER June 2014 - 73
POWER June 2014 - 74
POWER June 2014 - 75
POWER June 2014 - 76
POWER June 2014 - 77
POWER June 2014 - 78
POWER June 2014 - 79
POWER June 2014 - 80
POWER June 2014 - 81
POWER June 2014 - 82
POWER June 2014 - 83
POWER June 2014 - 84
POWER June 2014 - Cover3
POWER June 2014 - Cover4
https://www.nxtbook.com/accessintelligence/POWER/pwr_march-2024
https://www.nxtbook.com/accessintelligence/POWER/pwr_february-2024
https://www.nxtbook.com/accessintelligence/POWER/pwr_january-2024
https://www.nxtbook.com/accessintelligence/POWER/pwr_december-2023
https://www.nxtbook.com/accessintelligence/POWER/pwr_november-2023
https://www.nxtbook.com/accessintelligence/POWER/power-october-2023
https://www.nxtbook.com/accessintelligence/POWER/re-tech-supp-to-power-september-2023
https://www.nxtbook.com/accessintelligence/POWER/power-september-2023
https://www.nxtbook.com/accessintelligence/POWER/power-and-re-tech-supp-september-2023
https://www.nxtbook.com/accessintelligence/POWER/power-august-2023
https://www.nxtbook.com/accessintelligence/POWER/power-july-2023
https://www.nxtbook.com/accessintelligence/POWER/power-june-2023
https://www.nxtbook.com/accessintelligence/POWER/power-may-2023
https://www.nxtbook.com/accessintelligence/POWER/power-april-2023
https://www.nxtbook.com/accessintelligence/POWER/power-march-2023
https://www.nxtbook.com/accessintelligence/POWER/power-february-2023
https://www.nxtbook.com/accessintelligence/POWER/power-january-2023
https://www.nxtbook.com/accessintelligence/POWER/power-december-2022
https://www.nxtbook.com/accessintelligence/POWER/power-november-2022
https://www.nxtbook.com/accessintelligence/POWER/Power-October-2022-140th-Anniversary-Supp
https://www.nxtbook.com/accessintelligence/POWER/Power-October-2022-and-Anniversary-Supp
https://www.nxtbook.com/accessintelligence/POWER/power-and-re-tech-supp-september-2022
https://www.nxtbook.com/accessintelligence/POWER/power-september-2022
https://www.nxtbook.com/accessintelligence/POWER/power-august-2022
https://www.nxtbook.com/accessintelligence/POWER/Power-July-2022-Intl
https://www.nxtbook.com/accessintelligence/POWER/power-july-2022
https://www.nxtbook.com/accessintelligence/POWER/power-june-2022-intl
https://www.nxtbook.com/accessintelligence/POWER/power-june-2022
https://www.nxtbook.com/accessintelligence/POWER/power-may-2022
https://www.nxtbook.com/accessintelligence/POWER/power-may-2022-intl
https://www.nxtbook.com/accessintelligence/POWER/power-april-2022
https://www.nxtbook.com/accessintelligence/POWER/Power-April-2022-Intl
https://www.nxtbook.com/accessintelligence/POWER/power-march-2022
https://www.nxtbook.com/accessintelligence/POWER/power-february-2022
https://www.nxtbook.com/accessintelligence/POWER/power-january-2022
https://www.nxtbook.com/accessintelligence/POWER/power-december-2021
https://www.nxtbook.com/accessintelligence/POWER/power-top-plants-supp-december-2021
https://www.nxtbook.com/accessintelligence/POWER/power-november-2021
https://www.nxtbook.com/accessintelligence/POWER/power-october-2021
https://www.nxtbook.com/accessintelligence/POWER/power-september-2021
https://www.nxtbook.com/accessintelligence/POWER/power-august-2021
https://www.nxtbook.com/accessintelligence/POWER/power-july-2021
https://www.nxtbook.com/accessintelligence/POWER/power-june-2021
https://www.nxtbook.com/accessintelligence/POWER/power-may-2021
https://www.nxtbook.com/accessintelligence/POWER/power-april-2021
https://www.nxtbook.com/accessintelligence/POWER/power-march-2021
https://www.nxtbook.com/accessintelligence/POWER/power-february-2021
https://www.nxtbook.com/accessintelligence/POWER/power-january-2021
https://www.nxtbook.com/accessintelligence/POWER/power-december-2020
https://www.nxtbook.com/accessintelligence/POWER/power-november-2020
https://www.nxtbook.com/accessintelligence/POWER/power-october-2020
https://www.nxtbook.com/accessintelligence/POWER/power-september-2020
https://www.nxtbook.com/accessintelligence/POWER/power-august-2020
https://www.nxtbook.com/accessintelligence/POWER/power-july-2020
https://www.nxtbook.com/accessintelligence/POWER/power-june-2020
https://www.nxtbook.com/accessintelligence/POWER/power-may-2020
https://www.nxtbook.com/accessintelligence/POWER/power-april-2020
https://www.nxtbook.com/accessintelligence/POWER/power-march-2020
https://www.nxtbook.com/accessintelligence/POWER/power-february-2020
https://www.nxtbook.com/accessintelligence/POWER/power-january-2020
https://www.nxtbook.com/accessintelligence/POWER/power-december-2019
https://www.nxtbook.com/accessintelligence/POWER/power-november-2019
https://www.nxtbook.com/accessintelligence/POWER/power-october-2019
https://www.nxtbook.com/accessintelligence/POWER/power-september-2019
https://www.nxtbook.com/accessintelligence/POWER/power-august-2019
https://www.nxtbook.com/accessintelligence/POWER/power-july-2019
https://www.nxtbook.com/accessintelligence/POWER/power-june-2019
https://www.nxtbook.com/accessintelligence/POWER/power-may-2019
https://www.nxtbook.com/accessintelligence/POWER/power-april-2019
https://www.nxtbook.com/accessintelligence/POWER/power-march-2019
https://www.nxtbook.com/accessintelligence/POWER/power-february-2019
https://www.nxtbook.com/accessintelligence/POWER/power-january-2019
https://www.nxtbook.com/accessintelligence/POWER/power-december-2018
https://www.nxtbook.com/accessintelligence/POWER/power-november-2018
https://www.nxtbook.com/accessintelligence/POWER/power-october-2018
https://www.nxtbook.com/accessintelligence/POWER/power-september-2018
https://www.nxtbook.com/accessintelligence/POWER/power-august-2018
https://www.nxtbook.com/accessintelligence/POWER/power-july-2018
https://www.nxtbook.com/accessintelligence/POWER/power-june-2018
https://www.nxtbook.com/accessintelligence/POWER/power-may-2018
https://www.nxtbook.com/accessintelligence/POWER/power-april-2018
https://www.nxtbook.com/accessintelligence/POWER/power-march-2018
https://www.nxtbook.com/accessintelligence/POWER/power-february-2018
https://www.nxtbook.com/accessintelligence/POWER/power-january-2018
https://www.nxtbook.com/accessintelligence/POWER/power-december-2017
https://www.nxtbook.com/accessintelligence/POWER/power-november-2017
https://www.nxtbook.com/accessintelligence/POWER/power-october-2017
https://www.nxtbook.com/accessintelligence/POWER/power-september-2017
https://www.nxtbook.com/accessintelligence/POWER/power-august-2017
https://www.nxtbook.com/accessintelligence/POWER/power-july-2017
https://www.nxtbook.com/accessintelligence/POWER/power-june-2017
https://www.nxtbook.com/accessintelligence/POWER/power-may-2017
https://www.nxtbook.com/accessintelligence/POWER/power-april-2017
https://www.nxtbook.com/accessintelligence/POWER/power-march-2017
https://www.nxtbook.com/accessintelligence/POWER/power-february-2017
https://www.nxtbook.com/accessintelligence/POWER/power-january-2017
https://www.nxtbook.com/accessintelligence/POWER/power-december-2016
https://www.nxtbook.com/accessintelligence/POWER/power-november-2016
https://www.nxtbook.com/accessintelligence/POWER/power-october-2016
https://www.nxtbook.com/accessintelligence/POWER/power-september-2016
https://www.nxtbook.com/accessintelligence/POWER/power-august-2016
https://www.nxtbook.com/accessintelligence/POWER/power-july-2016
https://www.nxtbook.com/accessintelligence/POWER/power-june-2016
https://www.nxtbook.com/accessintelligence/POWER/power-may-2016
https://www.nxtbook.com/accessintelligence/POWER/power-april-2016
https://www.nxtbook.com/accessintelligence/POWER/power-march-2016
https://www.nxtbook.com/accessintelligence/POWER/power-february-2016
https://www.nxtbook.com/accessintelligence/POWER/power-january-2016
https://www.nxtbook.com/accessintelligence/POWER/power-december-2015
https://www.nxtbook.com/accessintelligence/POWER/power-november-2015
https://www.nxtbook.com/accessintelligence/POWER/power-october-2015
https://www.nxtbook.com/accessintelligence/POWER/power-september-2015
https://www.nxtbook.com/accessintelligence/POWER/power-august-2015
https://www.nxtbook.com/accessintelligence/POWER/power-july-2015
https://www.nxtbook.com/accessintelligence/POWER/power-june-2015
https://www.nxtbook.com/accessintelligence/POWER/power-may-2015
https://www.nxtbook.com/accessintelligence/POWER/power-april-2015
https://www.nxtbook.com/accessintelligence/POWER/power-march-2015
https://www.nxtbook.com/accessintelligence/POWER/power-february-2015
https://www.nxtbook.com/accessintelligence/POWER/power-january-2015
https://www.nxtbook.com/accessintelligence/POWER/power-december-2014
https://www.nxtbook.com/accessintelligence/POWER/power-november-2014
https://www.nxtbook.com/accessintelligence/POWER/power-october-2014
https://www.nxtbook.com/accessintelligence/POWER/power-september-2014
https://www.nxtbook.com/accessintelligence/POWER/power-august-2014
https://www.nxtbook.com/accessintelligence/POWER/power-july-2014
https://www.nxtbook.com/accessintelligence/POWER/power-june-2014
https://www.nxtbook.com/accessintelligence/POWER/power-may-2014
https://www.nxtbook.com/accessintelligence/POWER/power-april-2014
https://www.nxtbook.com/accessintelligence/POWER/power-march-2014
https://www.nxtbook.com/accessintelligence/POWER/power-february-2014
https://www.nxtbook.com/accessintelligence/POWER/power-january-2014
https://www.nxtbook.com/accessintelligence/POWER/power-december-2013
https://www.nxtbook.com/accessintelligence/POWER/power-november-2013
https://www.nxtbook.com/accessintelligence/POWER/power-october-2013
https://www.nxtbook.com/accessintelligence/POWER/power-september-2013
https://www.nxtbook.com/accessintelligence/POWER/power-august-2013
https://www.nxtbook.com/accessintelligence/POWER/power-july-2013
https://www.nxtbook.com/accessintelligence/POWER/power-june-2013
https://www.nxtbook.com/accessintelligence/POWER/power-may-2013
https://www.nxtbook.com/accessintelligence/POWER/power-april-2013
https://www.nxtbook.com/accessintelligence/POWER/power-march-2013
https://www.nxtbook.com/accessintelligence/POWER/power-february-2013
https://www.nxtbook.com/accessintelligence/POWER/power-january-2013
https://www.nxtbook.com/accessintelligence/POWER/power-december-2012
https://www.nxtbook.com/accessintelligence/POWER/power-november-2012
https://www.nxtbook.com/accessintelligence/POWER/power-october-2012
https://www.nxtbook.com/accessintelligence/POWER/power-september-2012
https://www.nxtbook.com/accessintelligence/POWER/power-august-2012
https://www.nxtbook.com/accessintelligence/POWER/power-july-2012
https://www.nxtbook.com/accessintelligence/POWER/power-june-2012
https://www.nxtbook.com/accessintelligence/POWER/power-may-2012
https://www.nxtbook.com/accessintelligence/POWER/power-april-2012
https://www.nxtbook.com/accessintelligence/POWER/power-march-2012
https://www.nxtbook.com/accessintelligence/POWER/power-february-2012
https://www.nxtbook.com/accessintelligence/POWER/power-january-2012
https://www.nxtbook.com/accessintelligence/POWER/power-november-2011
https://www.nxtbook.com/accessintelligence/POWER/power-october-2011
https://www.nxtbook.com/accessintelligence/POWER/power-september-2011
https://www.nxtbook.com/accessintelligence/POWER/power-august-2011
https://www.nxtbook.com/accessintelligence/POWER/power-july-2011
https://www.nxtbook.com/accessintelligence/POWER/power-june-2011
https://www.nxtbook.com/accessintelligence/POWER/power-may-2011
https://www.nxtbook.com/accessintelligence/POWER/power-april-2011
https://www.nxtbook.com/accessintelligence/POWER/power-march-2011
https://www.nxtbook.com/accessintelligence/POWER/power-february-2011
https://www.nxtbook.com/accessintelligence/POWER/power-january-2011
https://www.nxtbook.com/accessintelligence/POWER/power-december-2010
https://www.nxtbook.com/accessintelligence/POWER/power-november-2010
https://www.nxtbook.com/accessintelligence/POWER/power-october-2010
https://www.nxtbook.com/accessintelligence/POWER/power-september-2010
https://www.nxtbook.com/accessintelligence/POWER/power-august-2010
https://www.nxtbook.com/accessintelligence/POWER/power-july-2010
https://www.nxtbook.com/accessintelligence/POWER/power-june-2010
https://www.nxtbook.com/accessintelligence/POWER/power-may-2010
https://www.nxtbookmedia.com