Utility Week - authoritative, impartial and essential reading for senior people within utilities, regulators and government
Issue link: https://fhpublishing.uberflip.com/i/425912
UtILItY WeeK | 5th - 11th December 2014 | 25 Operations & Assets Market view Guarding against cyber attack The cyber threat to utilities should be taken as seriously as physical security, says Tony Burton. A recent story of drones circling French nuclear plants was a visual reminder of how the con- nected world allows anonymous intrusions into our critical utilities. Their purpose is not known, but the ability to remotely attack or infiltrate power, water and telecoms infrastructure offers opportunities for would- be attackers – a group that includes terrorists, activists, hackers and nation states. There are two obvious targets: control systems, which could be attacked to interrupt operations; and data, which could be stolen for competitive advantage. The former is potentially devastating but rare in practice; the latter is more commonplace. The enormity of the cyber-security challenge could not have been foreseen when much of our current infra- structure was built. The result is a number of potentially serious vulnerabilities across ageing systems. Connectivity, while essential for efficient operations, poses a challenge for security. It is therefore necessary to consider how you secure the people, processes, physical and cyber aspects of that network to ensure the security boundary is maintained. There is a growing body of evi- dence to suggest that a significant number of these sys- tems have already been penetrated and there needs to be a concerted effort to address these issues. The following gives a starting point for securing utili- ties or building them anew: • Identify vulnerabilities. Do a thorough audit of where you have unnecessary connectivity. • Secure your critical environment. Ensure physical and digital air gaps between publicly accessible net- works and spaces and industrial control systems. • Secure your perimeter. Draw a circle round your facil- ity and identify ways in – physical or digital, then find the best way to secure it. • Prevent information leaving. Data tagging can ensure anything critical is stopped on its way out of the net- work, whether emailed, hacked or downloaded. • Vet people. People will always present the biggest weakness, no matter how good the technological defences are. • Implement a cyber-incident response strategy. If things do go wrong, make sure you know what to do to recover from the attack. Physical security on infrastructure is generally good – nuclear plants are built to withstand plane crashes. But in the modern world this is not enough. Utilities need to evolve their approach to cyber security, and fast. Tony Burton, director of protection systems, Thales UK However, in the water services sector, just having more data, or even informa- tion processed from data, does not of itself ensure confidence in stipulated outcomes, which are composites of inputs, outputs and perceptions, and whose measurement and expression to the consumer public are still a developing "science". Understanding of the what, when and how of data management goes hand in hand with development of the measurement and reporting. At Atkins we have been developing a strategic asset management mindset among our teams – behaviour is perhaps the most important soware element of asset man- agement and it is here where we are spend- ing more time and effort than in building data processing systems; currently the well- trained human mind is still one of the most powerful processors around. We seek to challenge solutions by step- ping back and considering the root cause of service deficiencies, by assessing trends in any available data and thereby seeking to understand and test the options for restoring or improving service, keeping the customers' interests in mind the whole time. Of course, data and systems are needed and better and more focused data helps. As more sensors become available and we start to collect more time series data, big data analytics can help us to reveal more and richer knowledge. In time, we expect to have greater control over networks and processes. This will enable us to more closely predict performance variability and more minutely and cost-effectively allow consumers to "not notice" water services. Except to occasionally consider how effective they have become. Mike Woolgar, market director for water, Atkins "Smarter water would allow systems and assets to be run closer to their limits of capacity and condition, so only what needs to be done to achieve the service levels required would be done, and then at the right time." investment More than £90 billion invested since 1990 costs The water used to flush the toilet costs 2p The water used to take a shower costs 9p The average single person uses 165 litres of water a day An average family of three uses 150 litres per person per day 25 billion litres of fresh water are abstracted every day for all users (England only) Every day the water industry collects and supplies more than 17 billion litres of water The industry collects and treats more than 16 billion litres of wastewater per day Flooding Losses from flooding in winter 2013/14 = £446 million; 18,700 flood claims (Association of British Insurers) Met Office statistics show that 2012 was the second wettest year in UK national records dating back to 1910 and just a few millimetres short of the record set in 2000