Implement Cost-Effective, Zero-Trust Remote Operations to Mitigate Cyber Risks and Maintain Operational Resilience

In January 2021, a hacker accessed the digital infrastructure controlling the water supply for Oldsmar, a Florida city of 15,000 people. The bad actor attempted to manipulate the city’s water supply, exploiting a vulnerability in the company’s IT-grade remote access software to alter levels of sodium hydroxide in the water supply, raising its concentration to dangerous levels. Thankfully, an employee noticed the unusual activity on his computer screen, thwarting the attack before it put people at risk.

The incident is emblematic of a shifting threat landscape for utility companies that have maintained operational continuity throughout the pandemic by embracing remote or hybrid work arrangements. Forced to rapidly respond to a once-in-a-generation pandemic, utilities deployed an ad hoc approach to remote operations, using extra IT remote control software licenses for accessing their critical systems.

However, as remote work becomes a permanent fixture rather than a reactionary trend, utilities must implement a secure and manageable remote operations platform including strong multi-factor authentication (MFA), OT protocol isolation, and user-to-asset connection logging, monitoring, and recording. For leaders looking to develop this capacity, here are three must-have components of any effective solution. 

Zero-Trust

Utilities are working diligently to provide reliable, affordable, and safe service to their customers while defending against an ever-expanding threat landscape. A recent study by Siemens and the Ponemon Institute found that 56% of utilities reported at least one shutdown or data loss event each year. Moreover, the study concluded, “as utilities increasingly adopt business models that connect OT power generation, transmission, and distribution assets to IT systems, critical infrastructure is more vulnerable to cyber attacks.”

However, the complex and expensive proposition of scaling IT cybersecurity architecture to OT creates complexity and often extends the attack surface to control systems. Effectively enabling secure remote operations requires a zero-trust OT platform to mitigate risks.

Utilities employing a zero-trust approach mitigate risks of ransomware and other malware by incorporating defensive best practices into their day-to-day operations. Key components of zero-trust remote operations include:

• Multi-factor authentication.
• Protocol isolation.
• Mediated secure file transfer.
• User-to-asset connection monitoring.
• Full user access logging and recording.

These elements will drastically reduce OT asset exposure to cybersecurity threats while ensuring service availability and public safety.

Cost-Effective

Many states and municipalities are grappling with rising costs and shrinking tax revenue because of the pandemic, making it more difficult for leaders to justify significant investments in threat mitigation. Consequently, many utilities use whatever is available for operational capability, including free extra remote control software licenses, while foregoing requisite cybersecurity tools and strategies.

Simply put, utilities are looking for affordable solutions. While some large utilities may have the financial capacity to develop specific OT security capabilities independent of IT, most utilities must find simple and secure OT remote operations solutions with built-in cybersecurity components.

Operational Resiliency

A utility’s IT network includes several departments, including billing, accounting, and human resources, that specialize in data privacy and confidentiality. As a result, IT and cybersecurity personnel direct their efforts to these priorities, working with a hyper-focused effort to secure confidential data.

In contrast, OT networks prioritize process and automation controls for physical systems, human-machine interface computing systems, and other associated applications. That’s why linking IT and OT networks requires effective solutions appropriate for OT workflows and requirements. For example, remote operations capacity can be enhanced and augmented by security features such as:

• Screen recording to diagnose user errors, train technicians, and assess automation or control issues.
• Granular role-based access to systems, including Remote Access Manager and File Transfer Manager.
• Reoccurring time windows for third-party vendor access to only their specific assets.
• Live user-to-asset connection monitoring to facilitate oversight and accountability.

At the same time, utilities can’t undermine operational resiliency with complex resource-intensive “fork-lifted” IT cybersecurity stacks. Therefore, effective OT remote operations empower utilities to securely collaborate with remote and onsite staff experts, remotely monitor and configure plant assets, diagnose and troubleshoot problems, and digitally operate, startup, or shut down plant operations.

Securing OT technology isn’t a balance between usability and security. An effective solution will balance both and increase operational resilience.

Keeping Remote Operations Secure, Affordable, and Manageable

It’s clear that utilities will continue to incorporate a hybrid work model into their operations, requiring them to enhance their remote operations capacity and cybersecurity capability.  Disaster in Oldsmar, Florida, was avoided because of an alert plant technician, allowing the utility and its customers to avoid devastating consequences. Moving forward, utilities need more secure, affordable, and manageable remote operations. Investing in an OT-specific secure solution will make the utility more operationally efficient and resilient. This strategy will get the attention of the financial and business managers so OT operations can reap the benefits of distributed teams without compromising safety or service and product availability.

—Bill Moore is the CEO and founder of XONA, providers of a unique “zero-trust” user access platform especially tailored for remote operational technology (OT) sites.