POWER December 2021 - 29

CYBERSECURITY
Leading Practices
Beyond basic hygiene, P&U companies
must adopt a security-by-design
mindset: the business must set and
understand cybersecurity principles and
objectives so they're considered when
new products and services are introduced
and technology is deployed, not
grafted on after the fact. P&U leaders reported
that only 37% are being engaged
with adequate time by the business to
address cybersecurity for new technology
being implemented. Considering the
risk environment, cybersecurity should
always be consulted early in the design
or pre-implementation phases of a project-whether
it's for a rollout of smart
meters and other intelligent grid digital
assets, or within traditional power plants
or renewable installations, for example.
Aligning to a zero-trust architecture
(ZTA) equips organizations to achieve
this by default, because the key principles
mandate that your assets connect
to other resources only with a business
reason and authorization. Amid a proliferation
of connected devices and cloud
technology, ZTA is oriented around what
devices and components do, more than
where they come from, and " zero trust "
means that verification is required for
each connection. This replaces outdated
strategies focused on securing a perimeter
around a network and scrutinizing
those outside that perimeter, as a trusted
device in the wrong hands can still
inflict serious damage, and the bounds
of the perimeter can be hard to define. In
May, the Biden administration issued an
executive order on cybersecurity explicitly
stating that the federal government
is moving toward adopting ZTA, and the
Department of Energy is likely to endorse
ZTA in its sector-specific cybersecurity
initiative, still under development.
While technology developments have
opened up new potential for attacks, they
also offer new methods for bolstering
defenses. Monitoring and recognizing
malignant activity with this environment
of connected devices and cloud access
goes beyond what is humanly possible
to track. Therefore, security teams need
visibility at an automated scale-relying
on artificial intelligence, for example, to
identify and surface anomalies, prioritized
by risk.
Sophisticated P&U companies are
also building or leasing lab time to test
their hardware, software, and communication
protocols and networks before
committing to large deployments-an
ahead-of-the-curve approach for embedDecember
2021 | POWER
2. This graphic shows the percentage of responses received from personnel in the human
resources (HR), business line, and product development/research and development (R&D) departments
of companies that participated in the EY Global Information Security Survey 2021
when asked to describe the relationship between the security team and other functions of their
companies. Courtesy: Ernst & Young Global Limited
ding security by design. This exercise
could include mocking up the current
grid, bringing potential new devices into
the existing environment, and testing for
unexpected vulnerabilities and potential
issues related to performance.
Leading individual P&U companies,
device manufacturers, consultancies,
and some industry groups have also
created OT " honeypots. " The basic idea
is to create a mockup of a device or set
of devices, let them be " visible " to the
internet, and then collect and analyze
data related to how and how quickly
the device is identified and what threats
surface. The organizations can then use
that information to determine where and
how to evolve defenses.
Getting More Internal and External
Help
Cybersecurity leaders wishing to pursue
such strategies may find themselves
crashing against internal roadblocks: without
strong ties to the business, their functions
are easily cast as an inhibitor rather
than an enabler. Just 46% of P&U respondents
in the EY survey are confident
in the security team's ability to speak the
same language as peers in the business,
and only 31% believe they are seen as
supporters of innovation (Figure 2).
Compared to other sectors, P&U
faces a unique challenge in that investments
are driven by an expectation of
a rate of return over time, and cybersecurity
is labeled an operating expense.
Amid tight budgets, boards are prioritizing
functions where there is a clear
route from investment to added value.
Therefore, they can be more receptive
toward buying tools to save money-but
not optimizing or maintaining them. Security
leaders should make the case that
investing wisely and getting the most
out of their tools enables the business
to make smarter decisions on risk. Most
of us don't think twice about getting on
a plane and flying through the air at 500
www.powermag.com
miles per hour at 36,000 feet, because
the security protocols in place make us
feel protected. Similarly, the business
can accelerate its plans and reach new
heights if its cybersecurity protections
instill the right level of confidence.
It's also worthwhile to look outside
your organization, including at public-private
partnerships and collaboration opportunities.
Executives may fear that when
they have conversations with regulators,
or other parts of the government that may
interact with regulators, that they're going
to legislate what must be done. This risks
adding to what is perceived as an already
significant compliance burden. However,
because these risks are to our nation's
critical infrastructure, and not just to one
company's equipment, P&U organizations
cannot always effectively mitigate risks
independently. The way for these discussions
to be most impactful and focused
is strong engagement between industry
and regulators.
While the battle against digital threats
continues to grow more intense and
complex, P&U companies are making
progress. Increasingly, there are new
tools and more resources to draw on,
and more business leaders are becoming
attuned to the risks they face. To further
equip the business with confidence,
cybersecurity leaders must continue to
engage on increasing organizations' security
IQ, making the case to be involved
early and proactively, and continuing to
build security and resiliency capabilities
enabled by intelligent automation. ■
-Dillon Dieffenbach is a principal at
Ernst & Young LLP and serves as the
EY Americas Energy and Resources
Cybersecurity Leader. He has more than
20 years of experience helping companies
manage cybersecurity and technology
risks across the enterprise. The views
expressed are those of the author and
do not necessarily reflect the views of
Ernst & Young LLP or any other member
firm of the global EY organization.
29

http://www.powermag.com

POWER December 2021

Table of Contents for the Digital Edition of POWER December 2021