{"id":3367,"date":"2022-04-21T14:05:05","date_gmt":"2022-04-21T14:05:05","guid":{"rendered":"https:\/\/itegriti.com\/kw022024\/?p=3367"},"modified":"2022-09-12T10:47:44","modified_gmt":"2022-09-12T10:47:44","slug":"how-do-power-plants-and-renewables-differ-in-cybersecurity-requirements","status":"publish","type":"post","link":"https:\/\/itegriti.com\/kw022024\/2022\/compliance\/how-do-power-plants-and-renewables-differ-in-cybersecurity-requirements\/","title":{"rendered":"How do Power Plants and Renewables Differ in Cybersecurity Requirements"},"content":{"rendered":"

\u201cIn 2019, the renewable energy sector<\/a> recorded its largest ever increase in installed capacity, with more than 200 GW added, outpacing net installations in fossil fuels and nuclear power combined,\u201d reads a report from Accenture about the cyber state of renewables. With more surface area comes more attack surface. Luckily, there are measures in place<\/a> to combine energy and cybersecurity, such as the Federal Energy Management Program (FEMP)<\/a>. And, knowledge is power.<\/p>\n

Cybersecurity poses a serious challenge for renewables operators. Many of the systems currently in use were built prioritizing efficiency over security. Other risk factors include an ecosystem of original equipment manufacturers and third-party maintenance providers with lingering access to their assets, and the fact that many are still mired in manual processes. The road to full cybersecurity maturity for the renewable energy sector won\u2019t be easy, but in time it can develop into the security posture seen in traditional power plants. We\u2019ll go over the differences here, and what has to be done to close the gap.<\/p>\n

Renewables vs. Traditional Power Plants<\/strong><\/h2>\n

Renewable energy facilities and traditional power plants are not <\/em>the same thing; therefore, cybersecurity works a little differently for them, too. Traditional power plants run off exhaustible supplies like coal or natural gas. Once you use them, they\u2019re gone (sorry, Earth). Renewables<\/a> are just that \u2013 naturally replenishing but flow-limited resources like biomass, hydropower, geothermal, wind, and solar. This means you can\u2019t use them up, but you can also just use what\u2019s available at the time. It takes time to charge a solar panel.<\/p>\n

The main cybersecurity challenge between renewables and traditional power lies in environment structure. Renewables rely on more than one industry: water and power, wind and power, sun and power. You\u2019re combining two sectors, each with its own personnel, infrastructure, and security challenges. Think of the cybersecurity difficulties in combining IT\/OT: you\u2019re combining often up-to-date IT with often lagging legacy OT resources<\/a>, especially where much critical national infrastructure is concerned. Now imagine doing that for two different industries (each with its own IT\/OT problems). Now you\u2019re starting to see why securing the renewable power sector can be such a difficulty.<\/p>\n

Another challenge, ironically, is the expansion of technology. Renewable grides typically feature more IoT technology<\/a>, and that can be a [security] problem if not handled with care. With every new IoT device, smart water meter, or smart inverter on a solar panel, the attack surface (and risk potential) multiplies. Traditional power supplies \u2013 think coal, oil, and natural gas \u2013 only have to worry about gadgets infiltrating from one side: energy. Renewables have to deal with potential new technologies being integrated from multiple sectors and funneling into their electric grid. It\u2019s double the trouble.<\/p>\n

A third, and perhaps inescapable challenge, is that “going green\u201d is on the rise.\u00a0 That simply means the attack surface is growing with every new solar farm, hydropower plant, and windmill. If the sector\u2019s inherent cybersecurity problems aren\u2019t solved quickly, and at the root, they will just proliferate into each new build. These problems are dynamic, as opposed to those of the oil, coal, and fracking facilities that are increasingly being threatened with shut down<\/a> as we struggle to transition to clean energy.<\/p>\n

And lastly, a lack of regulations<\/a> for distributed energy resources (DERs) and inverter-based resources (IBRs). Says Kenneth Boyce, senior director for Principal Engineering with UL\u2019s Industrial group, \u201cCurrently, there are no cybersecurity certification requirements to which manufacturers and vendors can certify their DER devices and IBRs against an established and widely adopted cybersecurity certification program.\u201d He concludes that developing said requirements will provide a “single unified approach” for testing and certifying DERs before they are deployed in the field.<\/p>\n

How to Close the Gaps <\/strong><\/h2>\n

Although traditional power plants are streaking ahead in cyber safety, measures can be put in place to close the gap. Michael Sanchez, CEO (CISA, CCSFP) noted 10 essential steps<\/a> organizations can take today to improve their cybersecurity posture \u2013 no matter where they are on the maturity scale. They include:<\/p>\n

    \n
  1. A culture of cybersecurity<\/li>\n
  2. Asset inventory<\/li>\n
  3. Minimize attack surface<\/li>\n
  4. Identify business-critical data<\/li>\n
  5. Manage cyber and physical boundaries<\/li>\n
  6. Prepare for real-time events<\/li>\n
  7. The principle of least privilege<\/li>\n
  8. Manage vulnerabilities<\/li>\n
  9. Keep track of baselines<\/li>\n
  10. Balance preventative and protective controls<\/li>\n<\/ol>\n

    And, a report<\/a> from the Renewables Consulting Group (RCG) and cyber specialist Cylance recommends the following cybersecurity suggestions for the renewable power industry specifically:<\/p>\n