The utilities industry is undergoing a significant digital transformation to its operations that will transform the way they manage operations but also introduce new vulnerabilities through an expanded attack surface for adversaries to exploit. Over the last 10 years, there has been exponential growth in the deployment of digital assets by utilities into their field operations. Myriad external factors — climate change, societal pressures, advances in technology, battery storage, electric vehicles — are all contributing to a shift to a more distributed, digitally enabled electric grid. Gas utilities are facing pressure from the electrification of “everything,” while water utilities are facing water quality and water availability challenges. Internal factors are also playing a significant role. Operational efficiencies and cost savings offer significant benefits to the utility struggling to keep its cost of operations under control.
While we have seen significant advances over the last decade, the truth is we are still in the very early stages of this transformation. Artificial intelligence, machine learning, blockchain, 3D printing, and virtual and augmented reality — we have barely scratched the surface. All the more reason why we must take a pragmatic and risk-based approach to make sure the transition is done securely — and we need to start now.
OT systems for utility operations: then and now
Operational technology (OT) is defined as the hardware, software and networks dedicated to causing changes in physical processes through control of physical devices — or detecting changes in physical processes through monitoring physical devices. OT has existed in utility operations for decades. The most common are the industrial control systems (ICSs) that automate many activities in generating and delivering electricity and natural gas to customers. Such automation may have many hundreds or thousands of specific devices connected to the system, orchestrated together by Supervisory Control and Data Acquisition (SCADA) software and operated by code (called “ladder logic”) developed specifically to cause certain actions to occur upon the event of a specific trigger. Historically, these systems were not networked but mechanical, and those with digital controls used closed proprietary protocols. This had the same effect as a physical segmentation and provided security against internet or business network-based attacks and unauthorized changes. As a result, little, if any, attention was given to security.
Now take a moment to think about the nature of the assets being digitized. The devices are generally very rugged and purpose-built to last for many years in hostile environments that include heat, dust and vibration, not requiring regular, time-sensitive software updates/patches like systems on a business network. Their lifecycle can often be measured in decades. Each device and sensor could be made or manufactured by any of hundreds of vendors. The devices are physically dispersed over large geographic spaces – physically protected from tampering where possible. Their environment bears little resemblance to the IT environment — until now.
More recently, advances in wireless connectivity have improved the ability to remotely control and monitor physical devices. Advances in serial communications protocols allowed serial point-to-point communications to become more fault tolerant so that the signal can be sent via telephone lines, radio signals and even over the much less expensive Transmission Control Protocol (TCP). This innovation has allowed more effective remote operation of electrical and gas operations. Often, however, the conversion to use these newer communication methods involved the introduction of add-on technologies, such as serial to Ethernet converters. Conversion of serial communications to take advantage of communications media, such as networks and cellular modems, has also allowed these technologies to operate over the internet.