POWER June 2014 - 78

ELECTRIC POWER 2014 ROUNDUP
step, and all of the 13 ways he mentioned will
defeat firewalls.
It's not news that the bulk electric system
is vulnerable to cyber attacks. The North
American Electric Reliability Corp. (NERC),
under the direction of the Federal Energy
Regulatory Commission, has been working
for years on what has become an everchanging
landscape of rules and regulations
to protect " critical infrastructure, " known
to those who speak the jargon as " CIP " for
" critical infrastructure protection " standards.
NERC is now on the fifth iteration of its CIP
standards, aimed at protecting the bulk power
system, with version 3 in force and version
5 now leapfrogging the stillborn version 4.
(For more detail, see the set of special reports
on NERC CIP 5 in this issue.)
How to make sense out of the labyrinthine
course of the NERC cybersecurity program and
its multiple versions? Mike Radigan of ABB
and Kim Legelis of Industrial Defender, a company
specializing in protecting control systems
in energy industries, including electricity, oil,
and natural gas (and recently acquired by defense
behemoth Lockheed Martin), presented a
paper on the cybersecurity landscape for industrial
control systems and CIP 5.
They noted that the Department of HomeIf
you need information on
the global power
generation industry,
look to
first.
land Security's Industrial Control System Cyber
Emergency Response Team (ICS-CERT)
recently reported 200 attacks in a six-month
period, a " drastic " increase, with most targeting
the energy sector. Attempts ranged from
" brute force " to " sophisticated. " While most
cybersecurity programs are focused on protecting
enterprise IT systems, industrial control
systems present different characteristics.
Enterprise IT, they noted, seeks to protect
information, while ICSs are keyed to physical
processes. Enterprise IT is looking to prevent
financial loss, while ICS threats are not
only financial but also threaten public health
and safety and the environment. Enterprise
IT's focus is on central servers, while an
ICS is by its nature widely distributed. Enterprise
IT protection aims for 95% to 99%
system availability; ICS is looking for 99%
to 99.999%.
" Cyber incidents are real, and cybersecuIN
PRINT, IN PERSON, AND ONLINE
POWER maga    COAL POWER
GAS PO  MANAGING    
   
    ELECTRIC POWER
www.powermag.com
To subscribe, visit
www.powermag.com/subscribe
or call 847-763-9509.
rity for industrial control systems must be
taken seriously, " said Radigan. " But it is a
challenge that can be met. "
The latest CIP standards are much more
risk-based, compared to the checklist approach
of previous NERC standards. The
early NERC CIP standards relied on compliance
rather than real security. " Version 5
represents a change in thinking by NERC
to security, " said Radigan. " It's not compliance, "
but it is giving those covered a means
to manage more effectively in order to protect
security. In this regard, he said, and other
speakers also noted, keeping up with cybersecurity
protection has gone far beyond the
conventional utility approach of maintaining
manual computer spreadsheets for tracking
critical infrastructure protection. The paper
outlined four important aspects of keeping
up with cybersecurity:
■ Automation: " Manual efforts take too long
and are error prone. "
■ Timeline requirements: " Make sure things
get done on time-or earlier! "
■ Data analysis: " Data from across devices
and systems related and supporting various
requirements " are vulnerable.
■ Documentation and reporting: " Excel is
not your friend. "
The bottom line, Radigan and Legelis said,
is, " Prepare your organization for the coming
NERC CIP v. 5 requirements and for reasonable
protection against cyber threats. " ■
-Kennedy Maize is a POWER
contributing editor.
78
www.powermag.com
POWER | June 2014
http://www.powermag.com http://www.powermag.com/subscribe http://www.powermag.com
POWER June 2014

Table of Contents for the Digital Edition of POWER June 2014
