Utility Week - authoritative, impartial and essential reading for senior people within utilities, regulators and government
Issue link: https://fhpublishing.uberflip.com/i/834039
24 | 9TH - 15TH JUNE 2017 | UTILITY WEEK Operations & Assets Market view T he threat of a cyber attack on the UK's critical national infrastructure (CNI) has been a major concern for quite a while now, so much so that Channel 4 aired its "what if " drama Blackout as far back as 2013. The drama drew attention to the chaos that would ensue if a terrorist organisa- tion made a successful cyber attack on our national grid. However, there are more ways to cause harm to our electricity or water systems. In November 2015, George Osborne, for- mer chancellor, warned that terrorist organi- sation ISIS posed a significant threat to the UK's infrastructure – particularly regarding the likelihood of a cyber attack. To protect against such a threat, the government is investing £2 billion in cyber security to bol- ster the country's defences. However, Mikko Hypponen, a cyber secu- rity specialist who has advised governments in the UK, US and Asia, thinks a wider view is needed to protect CNI. While Hypponen acknowledges that terror groups do pose a cyber threat, he believes that they are equally likely to target our infrastructure physically. In November 2015, global headlines reported that Paris was on high alert over a potential chemical attack on its water supply. This came about aer threats from ISIS and the the of 12 protective suits used to guard against chemical products and viruses like Ebola from a hospital complex, along with over 30 pairs of protective boots. The threat level was so severe that the French army was posted to various key facilities around Paris and regular water tests were undertaken. The physical threat to our water system is as real and potentially crippling as the cyber security threat and must be treated as such, something that is reflected in the importance placed on "resilience" in the Water Act 2014. The act came about to encourage reform in the water industry, in terms of both innova- tion and the resilience of water supplies. In addition to the primary duties outlined for water providers in England and Wales, the act stresses the need for long-term resil- ience of water and wastewater systems and service provision when faced with increas- ing external stresses. The latest government advice on the matter is included in a cabinet office paper entitled "Keeping the Country Running". This guidance defines resilience as "the ability of assets, networks and sys- tems to anticipate, absorb, adapt to and/or rapidly recover from a disruptive event". Two of the key pieces of advice covered are resistance (proofing a system so that it is resistant to known risks) and reliability (a system that operates effectively, irrespective of whether or not risks materialise). Achiev- ing both things to avoid disruption to vital water services relies heavily on physical security. The Centre for the Protection of National Infrastructure (CPNI), which protects national security by providing protective security advice, describes physical security as "measures [that] aim to either prevent a direct assault on premises or reduce the potential dam- age and injuries should an inci- dent occur". Among the measures CPNI considers to be priorities are CCTV, access control, perimeter protection, hostile vehicle mitigation, and explosives and ballistics protection. All of which are very important to protect key sites in our national infrastructure such as water treatment plants. However, what is rarely discussed in such detail by any organisation assessing the protection of our water or electricity supply are the more remote, smaller points where damage can be done – utility kiosks. These kiosks are usually at key points in the water network, including sites with equipment for the chlorination and treatment of the water supply and borehole sites, and they are oen in remote locations away from populated areas. The nature of these locations oen rules out effective perimeter or access control measures that would isolate these vulner- able areas of infrastructure. This means that the kiosks themselves must be able to with- stand any attempt to do harm. British Security Industry Association chief executive James Kelly says: "It is imperative that integrated and robust security measures are in place to secure sites of critical national importance, such as the nation's many utili- ties sites. A combination of technology, phys- ical security and the deployment of trained personnel is oen the most effective method of security integration, creating several lay- ers of defence to protect the most sensitive parts of the network. "When it comes to utility kiosks, site accessibility must also be a consideration. Characterised by their, oen remote, loca- tions, maintenance visits can be irregular and conducted by different staff. Therefore a balance needs to be found between secu- rity and accessibility. Solutions which can offer temporary access to mobile employees while balancing the need for high security, the ability to withstand attack and cope with potentially corrosive weather conditions would be beneficial to these sites." This is why kiosk manufacturers have to closely examine the materials and tech- niques they use when designing utility kiosks. We have invested time in researching and developing kiosks that can stand up to tampering. As a result, we can provide glass reinforced plastic kiosks, which can with- stand the elements and possible attack. We cannot be complacent about critical national infrastructure like our water sup- ply. One weak link in the chain and the next drama from Channel 4 on the topic won't be a "what if " drama, it will be a documentary. Just because utility kiosks are out of sight, they cannot be out of mind if we are going to protect our CNI. Nick Cowley, country manager, MCL Utility Let's get physical Much coverage has been given to the cyber threat posed by terrorism, but Nick Cowley argues that much more thought needs to be given to the importance of physical security. "What is rarely discussed in such detail by any organisation assessing the protection of our water or electricity supply are the more remote, smaller points where damage can be done – utility kiosks."