| Spotlight


and IoT. This means that the cyber risk exposure and attack surface is particularly vulnerable to threat actors. As cyber attacks grow in sophistication and severity, traditional preventative methods simply do not have the agility to effectively ward them off. Interconnectivity within hydropower is both an asset and a liability, making cyber attacks on organisations a case of when – not if! The government has already taken some important


steps5


to improve the cyber resilience of the UK’s critical national infrastructure. Likewise, the EU’s directive on security of network and information systems (NIS Directive) is an encouraging legislative measure, albeit with minimal enforcement at present. However, to be truly effective, a step change in cyber strategy is required. Regulations will only ever go so far in tackling the issue, so organisations must now develop a holistic view of cyber security that ensures visibility into site level OT traffic and vulnerabilities, protection and understanding of cloud and SaaS assets, and comprehensive analysis of user and identity behaviour.


The role of managed detection and


response While full prevention of cyber attacks is not possible, hydropower installations can be designed to be more cyber resilient – to withstand, adapt to and bounce back from attacks while continuing their critical operations.


Attacks will continue to plague the sector and


proper detection, response and remediation will be what makes the difference between those that make the news and those that don’t. As such, managed detection and response (MDR) is playing an increasingly vital role in mitigating cyber risk. MDR is a 24-hour cyber security service that combines modern security technology with human analysis, artificial intelligence and automation to rapidly detect, analyse, investigate and actively respond to threats, rather than simply generating alerts. Importantly, an MDR solution also allows businesses to develop a reference security architecture that facilitates the safeguarding of on-premise and legacy systems, SaaS solutions and cloud-based infrastructure applications. It also helps security teams to protect against and respond effectively to emerging security and user identity threats while reducing the dwell time of any breaches. For hydropower operators, MDR provides correlated visibility across OT and IT networks, effectively joining the dots and enabling security teams to focus on strategic priorities rather than chasing down the latest security vulnerabilities. It can be combined with ethical hacking techniques to simulate attacks and offer deep insights into the gaps in an organisation’s cyber security strategy. The collaborative process of identifying and closing the gaps – which is then validated through retesting – not only removes the risk but also educates teams on a range of cyber security best practice. The best forms of MDR utilise Extended Detection and Response (XDR) technologies which allow detection and response across endpoint, network, web and email, cloud and – importantly – identity, alongside a service wrap that goes above and beyond the capabilities of the technology. This means all users,


assets and data remain protected, regardless of where the attack comes from.


Becoming more cyber resilient To truly build cyber resilience, basic cyber security


hygiene practices, such as regular testing and patching of any systems connected to the internet and segmentation of networks, should be supplemented by proactive measures such as threat hunting and detection and response, to reduce the time from intrusion to discovery and limit damage from attackers. Regular red team assessments should also be used to identify and plan entry vectors into a cyber system, including physical security.


To strengthen their cyber defences in an


evolving threat landscape, hydroelectric developers and operators must shift their focus from outright prevention to improving cyber posture and resilience


Ensuring that new technologies, such as the


Internet of Things (IoT) and cloud, are fully covered and understood through measurable, punitive business directives, is essential in shoring up the cyber resilience of hydropower operations. Therefore, organisations that build and leverage cyber threat intelligence to inform prevention and detection capabilities will benefit from more focused security investments and resources – rather than scattergun attempts to stop everything. Only by implementing a strong risk management


procedure, broad-level monitoring and incident response, can organisations stay one step ahead of potential cyber threats and ensure all risks are dealt with and reflected upon in an efficient way, so that compliance, posture and infrastructure are not compromised.


Working with a trusted partner With an average growth of 4% per year, hydropower


is a key source for electricity generation – globally supplying 71% of all renewable electricity. Any interruption to this critical service could cause damaging financial loss and serious disruption to our everyday lives. However, to successfully drive cyber security


improvements, organisations face the challenge of maintaining system uptime whilst undergoing operationally and technically complex upgrades. Many of the systems currently in use by renewables operators were built prioritising efficiency over security. It is advantageous therefore to engage a security architect early in a project lifecycle to ensure better interoperability and integration with the existing estate. With the help of the right security partner – one that truly understands the OT and IT environment – organisations can overcome operational and technical complexities to transform cyber security while keeping critical services running. It will be those organisations that adopt a proactive approach to cyber security operations, by implementing a robust cyber security transformation process, underpinned by MDR, that will reap the benefits of a stronger, structured system for managing, isolating and reducing threats. ●


References


[1] https://www.bbc.co.uk/news/ world-us-canada-55989843


[2] https://www. cybersecurityconnect.com. au/critical-infrastructure/7321- hackers-target-qld-water- corporation-in-9-month-long-hack


[3] https://www.


bridewellconsulting.com/cni- cyber-report-risk-resilience


[4] https://www.bbc.co.uk/news/ business-48661152


[5] https://ukparliament. shorthandstories.com/jcnss-cni- report/index.html


www.waterpowermagazine.com | March 2022 | 9


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37