Cyber Security Strategy and Roadmap Template
by Annabelle Lee, Chief Cyber Security Specialist, Nevermore Security
1 CYBER SECURITY STRATEGY OVERVIEW
The current power grid consists of both legacy and next generation technologies. These new components operate in conjunction with legacy equipment that may be several decades old and provide no cyber security controls. In addition, industrial control systems/supervisory control and data acquisition (ICS/SCADA) systems were originally isolated from the outside world. Sensors would monitor equipment and provide that information to a control room center. As networking technology has advanced and become more accessible, utilities have made decisions to integrate systems. This integration is necessary to take advantage of the new technology that is being deployed.
To adequately address potential threats and vulnerabilities, and develop an effective cyber security strategy, the utility needs to have a current architecture that includes the system assets, communication links, and connections to external systems. Knowing the system boundaries and the assets that are within the boundary may be used to determine what needs to be protected. Currently, with the increase in wireless communications and the connection of Industrial Internet of Things (IIoT) devices, the overall attack surface has increased.
A cyber security strategy includes an integrated strategy to reduce cyber risks by addressing high-priority objectives and activities that will be pursued over the next few years to reduce the risk of energy disruptions due to cyber incidents. Because of the constantly changing threat and technology environments related to the digital infrastructure, the typical time frame for the activities in the strategy is one to three or five years.
In addressing cyber security, achieving 100% security of all systems against all threats is not possible. The number of resources (including funds, staff, and technology) are limited and all systems cannot and should not be protected in the same manner. Risk-based methods should be used to make decisions and prioritize activities. Because threats will not diminish, energy delivery systems must be designed and operated so they can continue to perform critical functions during and after an attack. Finally, cyber security features should not interfere with the energy delivery functions of the devices and components they are meant to protect.
The purpose of this document is to specify a cybersecurity strategy and roadmap template that may be used by utilities. This document is NOT an attempt to develop new guidance but rather document the diverse existing guidance that is available to the electric sector.