POWER May 2020 - 6

SPEAKING OF POWER
Cybersecurity Is More
Important Than Ever
Due to COVID-19
Aaron Larson
T
he COVID-19 outbreak has forced
many companies to change the
way they conduct operations.
Leaders have had to divide employees
into essential and non-essential
categories. Essential employees must
report to their worksites and perform
required tasks to keep businesses in
operation. Non-essential workers, while
still important and needed for the continued
success of companies, are often
being allowed to perform their duties
from home, at least in the short term,
by working over an internet connection
tied to their work computer or to a
cloud-based system.
I think most people would agree that
being able to work remotely is a blessing,
especially during a pandemic. Many
companies have been providing telework
capability for years-it comes in
handy whenever employees are traveling
for work or personal reasons. Remote
access also allows more flexible
work schedules, which can improve
morale and reduce employee turnover.
According to Gallup's State of the American
Workplace report, 43% of employees
in 2016 worked remotely in some
capacity. That was up 4% from 2012,
and it has most likely climbed even
more today.
A study published by the Boston
Consulting Group (BCG) says more
than 30 million office workers in the
U.S., and up to 300 million globally,
are expected to work from home due
to COVID-19. However, the report says
shifting work patterns on such a massive
scale can have serious unanticipated
cybersecurity implications. The
authors recommend seven steps companies
should take to safeguard systems
from cyber attacks. The actions
are somewhat general in nature and
apply to all industries.
Cybersecurity: A Team Effort
To get a more power industry-focused
perspective, I spoke to Leo Simonovich,
6
Siemens Energy's global head of Industrial
Cyber and Digital Security. On March
4, before strict COVID-19 lockdowns
were widely enacted, Simonovich led a
tabletop exercise at the 3rd annual Energy
Cyber Security Group vendor/operator
conference in London. Simonovich
walked attendees through a simulated
crisis in which a fictional city's main electric
utility
experienced a cyber attackcaused
blackout.
" It's important that we make these
exercises as realistic as possible, and involve
all parts of the organization and its
supply chain, " Simonovich told me after
the event. " If you look at the latest survey
that we did with the Ponemon Institute,
the majority of utilities can expect
at least one major attack that will lead to
a shutdown or a safety event. So, this is
a new reality that utilities are facing. And
today, one-third of them don't have an incident
response plan. "
The scenario Siemens devised drew
on a set of recent incidents in which intruders
entered systems through basic
vulnerabilities, then took advantage of
the high-tech, digitalized, distributed environment
where some utilities frankly
don't have great visibility. Simonovich
said it's that lack of visibility that leads cyber-attack
responders to search for more
information about the event so they can
put pieces of the puzzle together.
" It's something that they would undertake
at different levels of the organization
with different dimensions. So, for
example, the utility would consider: Do I
investigate my physical supply chain, at
the same time as an employee that has
gone missing, at the same time as I conduct
forensic analysis of my networks?
These pieces of information-are they
relevant to me or are they not? And this
is where being part of a multi-disciplinary
team where you engage vendors to support
you in identifying facts, and then
acting on those facts, is really important, "
he said.
Simonovich said there were two big
takeaways from the exercise. One was
www.powermag.com
that trustworthiness is vitally important.
" We as a community need to come together
to respond to a crisis, " he said.
" Many utilities today do not even have
the phone number of their suppliers that
they can call in case there is a cyber
event, let alone engaging them as part of
a multi-disciplinary team. "
The other was that utilities need to
take a proactive approach, and quickly,
yet thoroughly, identify what is likely
to have an impact on availability, reliability,
and safety. Simonovich said
Siemens has been responding to cyber
incidents for more than 30 years.
It operates about 400 factories and 80
power plants for customers around the
world, so the company's insight comes
from practical experience.
" Every one of our customers needs
to have a plan that involves us in helping
them respond to attacks and vice versa,
because we are increasingly interdependent
on each other because of digitalization, "
said Simonovich. To learn more
about Siemens' incident response playbook,
visit: www.bit.ly/Siemens-Cyber.
Avoiding Viruses
I found one analogy from the BCG report
particularly profound. The authors wrote,
" Cyber attacks are like the COVID-19 virus
itself. Patching your systems is like
washing your hands. And not clicking on
phishing emails is like not touching your
face. " I would take it a couple of steps
further and suggest that maintaining
good firewalls is akin to wearing a mask
in public. And having air gaps in vital networks
is similar to the now-common sixfoot
social distancing rule. Suddenly, it's
obvious that the term " computer virus "
was appropriately coined.
During this challenging time when so
many people are working remotely, it's
more important than ever to keep cybersecurity
top of mind. Please do your part
to stay safe and healthy, both physically
and digitally. ■
-Aaron Larson is POWER's
executive editor.
POWER | May 2020
http://www.bit.ly/Siemens-Cyber http://www.powermag.com
POWER May 2020

Table of Contents for the Digital Edition of POWER May 2020
