| Cyber security
of exploitation. The best cybersecurity programmes can’t protect an enterprise when human actors unintentionally or maliciously compromise the enterprise,” Gopal et al say. “To confront this rising threat, more than half of chief information security officers will adopt formal insider risk management programmes by 2025 and pay for them primarily by promising early detection and prevention of data exfiltration.” Furthermore, Gartner defines insider risk as “the
potential for an individual who has or had authorised access to either maliciously or unintentionally act in a way that could negatively affect the organisation.” And by 2025, insider risk will cause 50% of organisations to adopt formal programmes to manage it, up from 10% today. Looking to the future, cybersecurity leaders need
to think beyond just phishing testing and resilience to social engineering. Helping business leaders make good threat-aware decisions and focusing on the early detection of risky behaviour by employees will result in organisations being able to take a proactive approach to minimise the risk and increase enterprise agility. Far greater returns are to be had in elevating the conversation to value propositions and business/ operating models.
As digital business itself matures from a culture of
exploration to ‘business as usual’ it not only brings massive advantage to organisations but changes the nature, quantity, and impact of risks. Gopal et al add that it’s important for cybersecurity leaders to stress to stakeholders that investment in cybersecurity means the ability to be a digital business. The Gartner report also goes on to discusses the importance of embedding cybersecurity as an ideology in organisations and flipping mindsets. “No one ever argues against profitability or mission success because those are core values of an organisation. Cybersecurity falls to a distant Nth on the scale of enterprise priorities when it clashes with the profitability or mission success. Yet, when we look at mining, oil and gas, and energy and utilities companies, we see safety as a top priority alongside profitability. The ideology of ‘safety’ is now on par with profit across asset-heavy industries. Although it took dramatic oil platform failures and mining collapses to change that dynamic, once it became clear that cost-cutting on safety costs lives and ultimately affects the bottom line, the ideology changed. “It’s easy to think of cybersecurity as something ‘separate’ when you think of enterprise success being due largely to people being supported by machines. But just as with assembly line manufacturing, enterprise success today is largely driven by machines underpinned by people. CISOs can gain a lot of mileage,” the report adds, “simply helping one’s enterprise realise that cyber, like asset maintenance, and safety are core to the enterprise’s value proposition, not something separate.”
Hydropower CVF
Over 40 cyber-attacks in the past 20 years have targeted US hydropower facilities, including both information technology (IT) and operational technology (OT) with a clear trend of increasing OT system focus.
www.waterpowermagazine.com | October 2023 | 13 “As hydropower plants become increasingly
integrated via advanced smart devices alongside legacy systems, it is critical to address the cybersecurity challenges that arise,” Sanghvi et al explain in a new paper published by the National Renewable Energy Laboratory in the US. “One barrier to deploying an effective programme of cybersecurity measures is the lack of a formal methodology to assess the value of improving the hydropower cybersecurity posture,” the authors state, adding that without such guidance, “it is difficult for hydropower plant managers to justify or prioritise investments in improving their plant’s cybersecurity maturity and to harden their plants against cyberattack”.
With this in mind, the National Renewable Energy Laboratory (NREL) and Argonne National Laboratory, with support from the US Department of Energy’s Water Power Technologies Office, have developed an industry-accessible tool for user-friendly, risk-based cybersecurity assessments of hydropower plants and dams. The Hydropower Cybersecurity Value-at-Risk Framework (CVF) is implemented as an online web application that takes “a novel approach of conducting risk-based valuation assessments” and walks users through a series of questions to create a semiquantitative value-at-risk score, as well as a prioritised set of recommended actions to improve cybersecurity posture.
Sanghvi et al also discuss how the capabilities of the CVF will be improve. This includes development of a pipeline for the automated tagging of threats to controls and for the automated analysis of the common vulnerabilities and exposures that might be relevant to systems.
Other advancements of the CVF application will include an organisational view of cybersecurity risks, including multiple assessment results from different facilities within the organisation. “The CVF provides a bird’s-eye view of the value of investments in cybersecurity to enable enhanced decision making for stakeholders,” the authors conclude, adding that as it is continually refined, the benefits to the cybersecurity posture of hydropower will continue to grow.
References
Predicts 2023: Cybersecurity Industry Focuses on the Human Deal By Deepti Gopal, Leigh McMullen, Andrew Walls, Richard Addiscott, Paul Furtado, Craig Porter, Oscar Isaka AND Charlie Winckless. Published 25 January 2023 - ID G00778825.
www.gartner.com/ doc/reprints?id=1-
2D7XIUC3&ct=230413&st=sb
Sanghvi, Anuj, Ryan Cryar, Jordan Smart, Nate Evans, Amanda Joyce, and Stephanie Jenkins. 2023. Hydropower Cybersecurity Value-at-Risk Framework. Golden, CO: National Renewable Energy Laboratory. NREL/TP-5R00-84841.
https://www.nrel.gov/docs/ fy23osti/84841.pdf
Over 40 cyber attacks in the past 20 years have targeted hydropower facilities in the US
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40 |
Page 41 |
Page 42 |
Page 43 |
Page 44 |
Page 45 |
Page 46 |
Page 47 |
Page 48 |
Page 49 |
Page 50 |
Page 51 |
Page 52 |
Page 53
