{"id":4040,"date":"2023-04-24T12:41:44","date_gmt":"2023-04-24T12:41:44","guid":{"rendered":"https:\/\/itegriti.com\/kw022024\/?p=4040"},"modified":"2023-04-24T12:45:41","modified_gmt":"2023-04-24T12:45:41","slug":"best-practices-for-the-energy-trilemma","status":"publish","type":"post","link":"https:\/\/itegriti.com\/kw022024\/2023\/compliance\/best-practices-for-the-energy-trilemma\/","title":{"rendered":"Best Practices for the Energy Trilemma 2023"},"content":{"rendered":"

Several security and research heavyweights weigh in on the pressing security issues facing the energy sector this year and what can be done about them. Learn what McKinsey, NIST, and FERC have to say about this year\u2019s energy threat climate and which \u201cnext steps\u201d matter most. <\/em><\/p>\n

Maintaining the energy trilemma is a monumental task, especially in today\u2019s threat climate<\/a>. Providing energy that is sustainable, affordable, and secure has never required more time, more resources, more oversight, and more foreplanning. Thankfully, there are some security best practices that, if implemented, will give energy companies the boost they need to feel that at least one of the three elements is safely taken care of.<\/p>\n

Drawing from a number of reputable sources \u2013 McKinsey, NIST, and FERC \u2013 reveals several proposed best practices that have bubbled to the surface in the wake of last year\u2019s threats. Here\u2019s a rundown.<\/p>\n

McKinsey: Simplify, cross-train, and digitize<\/h2>\n

Research and consulting firm McKinsey<\/a> states that leading companies begin their journey towards future-proof viability by simplifying, staying organizationally agile, and digitizing where it makes sense. This aligns not only in operations but within a security context as well.<\/p>\n

In simplification, the trend towards uniform platforms and vendor consolidation negates the effects of inherited tool sprawl. A consolidated vendor approach can create cleaner leadership points of contact when troubleshooting security strategy and can build a relationship that lasts long enough for the vendor to provide some real insights.<\/p>\n

Organizational agility comes from cross-training your teams (upskilling, reskilling) so you plan workarounds to the ongoing cyber talent crisis right into your strategy. Align tasks around clear business missions (what\u2019s the next big security goal?) and sacrifice work on any other project until those are done. Increased threats and decreased resources result in organizations of all sizes needing to drill deeper into the means they already have and learn to do more with less.<\/p>\n

While this hardly bears repeating, increasing digital capabilities \u2013 such as security automation, autonomous detection and response, etc. – will only pay dividends in the future. First, it\u2019s fewer people on the job doing things manually. Secondly, the few you still have can be most effectively used by being trained on best-in-class solutions, not reinventing the wheel. And last, a little more time and effort and a security budget now (when threats will only trend higher year after year) will warrant a massive sigh of relief in a year to come when advancing ecosystems and emerging threats become even more <\/em>out of reach for outdated processes alone.<\/p>\n

NIST: Governance, supply chain, and measurement<\/h2>\n

NIST Cybersecurity Framework 2.0<\/a> builds off the original, a set of guidelines designed to reduce risks and introduce best practices for detecting and responding to threats when they occur. This new version<\/a> focuses largely on the following:<\/p>\n

Governance<\/strong><\/h3>\n

This is a significant addition. For years, the NIST framework comprised the Functions \u201cidentify, protect, detect, respond, recover.\u201d Now, \u201cgovern\u201d is being thrown into the mix. Touted as a \u201ccross-cutting Function\u201d, governance can play a part in determining priorities, assessing risks, establishing procedures, and getting clear on roles and responsibilities. The takeaway? More top-down organization is needed to combat ineffective security resource management (in a year when we can afford it the least). This coincides with McKinsey\u2019s first and second points.<\/p>\n

Supply chain security <\/strong><\/h3>\n

This problem will only grow bigger, and the advice is to get on it now. As global supply chains (and software supply chains) continue to stretch, each with its own myriad of APIs, OS sources, and vendors of their own, the management becomes almost unreasonable. Add to that the additional partners connected to smart energy devices, charging stations, renewables, and consumer power-monitoring apps, and the real scope of the problem begins to take shape. NIST affirms that \u201ccybersecurity risks in supply chains and third parties are a top risk across organizations\u201d and that since the addition of supply chain security in the last update, \u201ceven more attention has been paid\u201d to building this out. Their advice? A cryptic, \u201cExpand coverage of supply chain.\u201d They leave it open for companies to battle out the details, but the directive is clear.<\/p>\n

FERC: Focus on Insider Threats<\/h2>\n

The Federal Energy Regulatory Commission (FERC) seeks to address concerns<\/a> that current energy security standards do not adequately address the risk of insider threat. Hence, they proposed new security requirements for high- and medium-impact bulk electric system (BES) facilities that would require these facilities to \u201cmaintain visibility over communications between networked devices<\/a>.\u201d<\/p>\n

Specifically, this translates to directing the North American Electric Reliability Corporation (NERC) to come up with some new Critical Infrastructure Protection (CIP) standards taking internal threats more into mind. In the meantime, the hint is clear, and there\u2019s no need for the private sector to wait: Find ways to reduce internal risk and consult with outside security agents if necessary.<\/p>\n

ITEGRITI has deep experience across critical infrastructure cybersecurity programs, compliance, risk, and audit.\u00a0 Contact us today to learn how we can leverage this experience to help you accomplish your cybersecurity goals.<\/p>\n

Contact Us: https:\/\/itegriti.com\/kw022024\/contact\/<\/a><\/p>\n

ITEGRITI Services: https:\/\/itegriti.com\/kw022024<\/a><\/p>\n<\/div>