Ensuring effective security in power generation--whether it's a power plant or distributed energy resource--is a constant battle. As systems and technologies grow more complex, keeping up with every threat, or every potential gap in security, becomes increasingly difficult.
In the age of Industry 4.0, much of the security focus is on cybersecurity, and while cyber security is of course extremely important, it is just one part of a plant’s overall security systems and processes. Stuxnet, one of the most infamous attacks in history, was ultimately transmitted onto sites via a USB stick carried by a human.
When potential vulnerabilities are found, it’s a race to find and mitigate them before someone else does. Realistically, you can never protect yourself fully from every conceivable future threat. However, while effective security is about finding and fixing potential threats, it is also about having the right policies and procedures in place to prevent or mitigate any consequences.
You may not be able to eliminate all risks entirely and indefinitely, but with robust processes and procedures, and adherence to best practices, you can considerably reduce the likelihood of having security systems compromised. Moreover, in the event that your systems are attacked by malicious actors, these same policies and procedures can significantly reduce the severity and cost of any attacks that do occur.
No two plants are the same, and as such, security policies and procedures will be different everywhere you go. Crucially, the threats will also be different. For example when people think of cyber-attacks, they often think of masked hackers hunched over screens in a back room somewhere in another country.
In reality, this is not where the majority of problems come from.
Air-gapping your O/T space is often good practice for industrial facilities. In an air-gapped system, firmware updates are often delivered by a person plugging in a USB drive precisely to avoid connecting to any external systems. While this might be sound practice, it is not a guarantee against attacks. The USB drive itself may be a threat, or the update it carries may have vulnerabilities or be installed incorrectly. This is where the policies and procedures come into play in understanding the biggest risks and taking steps to either eliminate them – or at least mitigate their impact.
Implementing effective security also requires pragmatism. There is a limit to how much security you can realistically put in before it starts compromising the productivity and efficiency of operations. If your systems are so secure that even authorised personnel have difficulty accessing them, then this can end up being counter-productive. As such, effective security means understanding the threats and the impact of mitigations, and weighing up the trade-offs that must be made between security and operational efficiency.
Learning from Mistakes
Many security professionals make their living out of identifying risks and finding flaws. Often the solutions will require investment, and this can understandably be uncomfortable to hear. At an executive level, it can represent additional money spent without a measurable return – you can’t put a price on the thing that doesn’t happen. Meanwhile, on-site engineers at a plant may be reluctant to grant third parties access to their systems (and rightly so – this is good security practice), and also may not appreciate having those systems scrutinized or be forced into making changes.
However, every vulnerability which can be detected and secured is one less possible vector by which your systems can be attacked. There will always be more threats to uncover – another hole to plug – but the reality is that if you don’t find them, someone else eventually will. To that end, mistakes need to be seen as a good thing, because each one is an opportunity to learn and improve – and these improvements can multiply to provide additional benefits.
Easy Wins for More Resilient Systems
Security, safety and reliability are all interlinked. Take care of one and it will make the others more effective. For instance, we find that many facilities have allowed their Single Line Diagram (SLD) to lapse. Having an up-to-date SLD is vital for lockout tagout, which is ostensibly a safety and security procedure. However, the SLD is also important for improving reliability, expediting troubleshooting, and streamlining upgrades and planning. From there you can improve your energy performance and sustainability and optimize plant performance to drive long-term profitability.
The National Fire Protection Association standard 70B (NFPA 70B) stipulates that infrared (IR) scans shall be carried out after start-up and commissioning of new equipment, and then every year thereafter. These help to detect hotspots which might be symptomatic of safety issues or inefficient operation. Any undue heat within a piece of equipment will reduce its lifetime.
IR scans are very easy to undertake. They can be carried out non-intrusively to gather information on where the potential safety risks and points of inefficiency are, and thus provide insight into where urgent maintenance may be required. Despite this, and the fact that they are mandatory in many parts of the world, many plants do not carry them out.
