Power lines stretch into the distance over the Meadowlands in New Jersey.
ASSOCIATED PRESSReleased last week with impressive fanfare but relatively scant detail, the Biden administration’s announcement that the Department of Energy and DHS’s Cybersecurity and Infrastructure Security Agency (CISA) would coordinate with our nation’s electric utility industry to raise the bar on industrial control system cybersecurity in the utility industry, was nevertheless received with a significant amount of optimism by the cybersecurity community.
This 100-Day Plan, when viewed along with with the Federal Energy Regulatory Commission’s (FERC) December 17, 2020 Notice of Proposed Rulemaking (NOPR) to establish an incentive-based framework for utilities that voluntarily make cybersecurity investments that exceed the current mandatory Critical Infrastructure Protection (CIP) Reliability Standards, and the forthcoming Department of Homeland Security’s “60-day sprint” initiative focused on industrial control systems, signify a new and welcome trend in government support for critical infrastructure.
These are promising signs of acknowledgement that the overused “public-private partnership” term to jointly solve these kind of massive problems will only work by departing from the historical ‘regulate and punish’ model of government oversight that I experienced far too often when I served as the Chief Security Officer at the North American Reliability Corporation (NERC).
The 100-day plan’s provision for active participation by electric utilities and others in a DOE Request for Information (RFI) on how to address supply chain cybersecurity heralds an opportunity for new innovation to address the growing global supply chain problem. Called a “pilot of the Administration’s broader cybersecurity initiative” by National Security Council spokesperson Emily Home, the 100-day plan explicitly identifies industrial control system (ICS) and operational technology (OT), and will serve as a platform to eventually address other critical infrastructures as opposed to previous federal initiatives which generally lacked any specific technology focus.
In an industry where infrastructure and systems have historically been purchased while planning for decades of use and depreciation, older technology and systems have resulted in significant tech-debt across the electricity industry. Enhancing cybersecurity “to increase visibility of threats in ICS and OT systems” in older embedded technologies will likely never be possible until utility companies are able to recover the costs of those investments, which are strictly limited by regulators at both the federal and state levels. More awareness of these security gaps that quite literally affect the safety of our society should result in a closer look by the federal government with potential funding to mitigate the gaps.
If I were a technology leader in the utility industry today, I’d be looking at the 100-day plan as an opportunity to identify long needed infrastructure enhancements.
1. The 100-day plan calls for owners and operators of utilities to “enhance their detection, mitigation and forensic capabilities.” This will only be possible through new investment so CIO’s, CISO’s, and electric utility technology leaders should begin reviewing their current technology and identify potential solutions to achieve these capabilities.
2. The 100-day plan calls for utilities “to identify and deploy technologies and systems that enable near real time situational awareness and response capabilities.” In addition to looking at new technologies, CIO’s and CISO’s should review and update their security policies that govern organizational situational awareness and incident response.
3. The Department of Energy’s request for information (RFI) is an unprecedented opportunity for the electric utility industry to provide direct input and collaborate with the government to shape the future of supply chain security.
The kind of public-private partnership identified in this 100-day plan is long-overdue. As Tim Roxey, one of the seers of cybersecurity in the electricity industry is fond of saying, “We didn’t know that what we were building 40 years ago was going to be called critical infrastructure or we would have planned better.” Now is the opportunity to remedy that lack of planning.