POWER April 2017 - 56

CYBERSECURITY
Cybersecurity: Keeping Current on
a Moving Target
What it means to have a secure energy generating facility has changed in recent
years as the threat of cyberattacks grows. As the nation's energy sector
becomes increasingly interconnected, it is more important now than
ever to safeguard power plants from cybersecurity threats such as hacking,
malware, and viruses.
Abby L. Harvey
T
he benefits of implementing an Internet
of Things (IoT) strategy at a power
plant are clear, but the stark reality
of this day and age is that doing so opens
many doors for cyber attackers. IoT at a
power plant can increase the efficiency of
the plant's operations, pinpoint maintenance
needs earlier than has ever been possible,
and help avoid costly operational failures.
However, with every new connection made
in a connected plant, a new vulnerability is
created.
The trick to having the best of both
worlds-a secure and connected plant-is
implementing a robust cybersecurity strategy
that can identify vulnerabilities as they
pop up, close them, and alert the user to any
breaches of the system's perimeter.
The Basics of a Secure Plant
With new threats cropping up every day, it is
debatable if a power plant can ever truly be
secure. A plant that is impervious one day
can be the target of an unheard of threat the
next. " We have kind of a failure of imagination
sometimes, about what those new threat
vectors could be, " Susan Peterson Sturm, director
of product marketing and strategy at
Honeywell Industrial Cyber Security, said.
Securing a plant is not a process with
an end point, Peterson Sturm suggested,
but an ongoing effort to stay abreast of an
ever-changing threat. " It's a misnomer to
say there is a secure plant. I think it's totally
cool for somebody to say we have approached
this with security by design, we
have implemented these security controls, "
she said.
Jon Stanford, Americas leader for IoT
services and advanced services, and global
practice lead for industrial securities with
Cisco Advanced Services, disagrees slightly,
saying that a plant can be truly secure
" if the security is addressed one, fundamentally,
and two, with the operational realities
of that plant in mind. "
56
1. The secure plant. Successfully securing a power plant from cyberattack requires several
levels of protection. Source: POWER/Sonal Patel
Stanford noted three key factors
that
must be present in a cybersecurity strategy
(Figure 1). First, he said, there must be a
focus on identifying threats and vulnerabilities.
" There's a lot of concern about the
threat actors and their motivations and how
vulnerable the IT environment is, " he said.
" The approach [to addressing that is] doing
vulnerability scanning, identifying those,
and then putting remediations in place. "
The second must-have for a secure plant,
Stanford said, is robust perimeter protection.
" Even though firewalls and intrusion
protection are not enough-they're table
sticks really today-you have to do them.
So do very robust separation between the
plant environment and anything external, "
he said.
Finally, according to Stanford, an operator
must develop a baseline by which they
www.powermag.com
can track any operational changes within the
plant, alerting them to any potential breaches.
" You want to have the ability to monitor
your environment and detect changes in real
time and respond to them, " he said.
The Least You Could Do
There is a minimum amount of effort that can
be put into a cybersecurity strategy. Threats
from outside actors abound, and doing nothing
is no longer an option.
In the past, that baseline was air-gapping.
Air-gapping is essentially protecting assets
by keeping them entirely disconnected from
the outside world. While that sounds like a
valid means to halt any external cyberthreats,
in 2017 there are a few problems with that
system. First, air-gapping only protects
against external threats. Unfortunately, that's
not enough. " It's erroneous, basically, to only
POWER | April 2017

http://www.powermag.com

POWER April 2017

Table of Contents for the Digital Edition of POWER April 2017