Spotlight |
Navigating the complex waters of cybersecurity
IWP&DC spoke to Phil Rouse, Advisor to Ground Control’s Chief Executive Officer, and Marlene Ladendorff, Principal Cybersecurity Consultant in Industrial Automation at Schneider Electric, to discover how we can safeguard the resilience of hydropower and dam infrastructure
IN AN ERA WHERE technological advancements propel operational efficiency, the hydropower and dams industry stands at a pivotal junction, poised between innovation and vulnerability. As our world becomes increasingly interconnected, this sector finds itself grappling with a multitude of cybersecurity threats that have the potential not only to disrupt power generation but also to compromise the safety and well-being of entire communities. By merging the insights of cybersecurity experts Phil Rouse and Marlene Ladendorff,, IWP&DC delves into the most pressing challenges, industry best practices, and crucial lessons learned, all aimed at fortifying the defenses of this indispensable critical infrastructure.
Diverse threats At the forefront of this digital battleground loom
the spectors of state-sponsored hacking and the exploits of profit-driven cybercriminals. Nation-states such as Russia, Iran, North Korea and China deploy sophisticated cyber intrusions to not only assess vulnerabilities but potentially destabilize economies and disrupt national security. Rouse paints a vivid picture of a world where hackers could manipulate intricate systems, disrupting water supply with the ability to create industrial accident type pollution, release of excessive water though malicious opening of sluice gates with the potential to cause reduction of generated power and flooding of a key industrial areas and draining of reservoirs supplying major towns and cities.
However, this digital theater isn’t limited to the grand stage of geopolitics. On a more covert front, hobby hackers are driven by profit, harnessing their technical prowess to extort organizations. Notable is the case of Colonial Pipeline, where ransomware attacks forced a payout of millions in cryptocurrency. This multifaceted threat landscape necessitates a holistic approach to cybersecurity, beginning with the convergence of operational technology (OT) and information technology (IT), a merger that promises seamless management while also laying bare the potential chinks in the digital armor. Ladendorff’s insights underscore the fact that the IT realm, often internet- facing, can inadvertently serve as a gateway for cyber adversaries to infiltrate the OT network, potentially compromising critical operations.
Best practices unveiled Against this backdrop, engineers must orchestrate
an intricate symphony of cybersecurity measures to ensure the security of their facilities. Ladendorff
10 | September 2023 |
www.waterpowermagazine.com
extols the value of comprehensive assessments to unveil vulnerabilities and prescribe tailored mitigation strategies. Rouse says that this crucial process encompasses: Strategic asset identification and risk assessment: The journey begins with identifying the most critical assets, followed by a meticulous evaluation of potential threats. Fortifying data and physical security: Encrypting data, enforcing stringent authentication protocols, and curbing physical access to sensitive zones form the bulwarks of cybersecurity. Cultivating cybersecurity savvy: The human element is a pivotal yet often underestimated factor in the cybersecurity equation. Integrating cybersecurity awareness, best practices, and reporting into the organizational culture is vital. Choreographing incident response: Preparing for the worst is a hallmark of resilience. Robust incident response strategies, encompassing containment, recovery, and thorough investigations, lay the groundwork for swift action in the face of a cyber onslaught. Evolving vigilance: Consistently assessing and enhancing security measures ensures that the defense mechanisms remain agile and adaptive.
Cognizance from crisis There are many accounts of cyber incidents that have
provided invaluable lessons. For example, Sunwater, a water supplier based in Queensland, was subjected to a protracted cybersecurity breach spanning nine months a few years ago. According to the Water 2021 report, the breach transpired between August 2020 and May 2021, involving unauthorized entry into the organization’s web server housing customer data. The report revealed that “threat actors” exploited a dated and more susceptible version of the system. While the breach’s repercussions were notable, the hackers primarily deposited dubious files on a webserver to reroute visitor traffic to an online video platform. Fortunately, no financial or customer information was compromised. The report underscored the necessity for swift actions to address and rectify the ongoing security vulnerabilities within the information systems. Key takeaways from the incident included
recommendations to enhance security measures. These encompassed the imperative to update software, fortify passwords, and rigorously monitor both incoming and outgoing network traffic. Similarly, Norsk Hydro’s tussle with LockerGoga
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53
