For power plants, the unintended consequence of “going digital” is dealing with cyber security. Almost everything that makes today’s distributed control systems (DCSs) and software so powerful, convenient, and cost-effective also makes them vulnerable to cyber attacks.
For years, the plants themselves were less vulnerable to such attacks than corporate institutions or the public at large because DCSs relied on proprietary protocols. But those systems were pried open to make them more interoperable, remotely accessible, and less costly. Now they use open software standards and protocols.
The opening up of plant systems has blurred the distinction between them and corporate information systems. Watching a plant engineer use a cell phone or PDA to call up a plant’s performance data and real-time operating parameters drives home the point. The “lines of communication” are now many and varied (see figure) and therefore vulnerable to intruders.
In the zone. Cyber security experts recommend dividing up the “meta organization” into zones requiring different protection schemes. Source: Trent Nelson, “Cyber Security—Who Needs It?” Idaho National Laboratory, Department of Homeland Security (April 18, 2007)
Crazy cyber quilt
Most plants manage cyber security by making a seemingly endless series of patches and security updates to their control and information systems. However, few plants have the resources to track the rise of viruses, worms, and other threats targeting them. Some plants rely on automated services provided by their DCS or software vendor. That’s convenient, but it also creates additional lines of vulnerability. Another level of complexity is introduced by the many DCS operating requirements that do not support the type of security models used by the rest of the IT industry.
The future, unfortunately, is even more complicated. New cyber security standards for critical infrastructure protection (CIP) that were approved in January by the Federal Energy Regulatory Commission (FERC) have changed the landscape. In short, the new standards (and other business drivers) will force plants to be proactive, rather than reactive, in their approaches to cyber security.
Asset managers seeking to counter the cyber security threat face a multifaceted challenge:
- The realm of plant automation and control is clashing head-on with that of corporate IT (see table). Digital systems may advance rapidly, but they become obsolete just as quickly. Each new technology paradigm, such as the “smart grid,” potentially adds another level of vulnerability.
- Many plant staffs have already been pared to the bone. Site expertise in cyber issues is rare to nonexistent.
- The new CIP standards (see sidebar, "New CIP standards leave much discretion to plant owners/operators")—which were developed by the North American Electric Reliability Corp. (NERC), FERC’s designated national electrical reliability organization—are ambiguous at best and arguably not even standards at worst. FERC’s authority to implement and enforce mandatory reliability standards is being challenged by many lawsuits. (For a listing and summaries of the cases, go to www.ferc.gov/legal/court-cases/pend-case.asp.) The suits don’t lessen the need for CIP projects, even if those suits take years to settle.
- Corporate owners have to meet other obligations, such as “public disclosure in the event of revenue flow disruption as a result of a cyber incident.” That’s the word from “Effective Practices for Securing Distributed Control Systems in Power Generation Facilities,” a white paper published by Symantec Enterprise Solutions and downloadable from https://www4.symantec.com/Vrt/offer?a_id=20174.
- Many plants today are linked, through wired or wireless connections, to centralized performance-monitoring facilities, employees responsible for multiple sites, mobile plant employees, corporate staff, vendors providing outsourced services, and even government agencies that monitor stack emissions. This so-called “meta organization” offers multiple points of vulnerability exploitable by miscreants.
- Plant assets include DCS or control systems of varying vintages, versions, and variations, depending on past modifications at the plant level.
IT systems and plant distributed control systems (DCS) treat aspects of cyber security very differently. Source: Trent Nelson, “Cyber Security—Who Needs It?” Idaho National Laboratory, Department of Homeland Security (April 18, 2007)
Email
Comments
Print
Reuse
