Solar generation has been around for a very long time. However, until recently, it always made up a very small percentage of global power generation. As a result, solar generation was never really considered critical infrastructure.
Today, however, that dynamic is changing, and as Emily Affare explores in her recent article in North American Clean Energy, it’s changing fast.
“The pace at which solar resources are being built and acquired to supplement energy generation portfolios is at a historic high. With additional production comes increased impact on the grid, and that impact leads directly to a higher level of criticality.”
That increase in criticality leads to increasing regulation—particularly in the cybersecurity arena.
“Already, regulatory agencies are signaling their recognition of the importance of renewables and the likelihood of increased regulation—including NERC CIP specifically—around their cybersecure operation. The days of “cybersecurity by obscurity” are nearing their end, and solar energy generators will soon need to regularly demonstrate adequate cybersecurity preparedness.”
As power generators increase their solar production, they also need to account for the potential increases in cybersecurity requirements they will need to meet. Getting started today will not only bring increased security sooner rather than later, but will also likely make the cybersecurity journey easier and more affordable.
OT is unique
OT teams have always had special cybersecurity needs. Uptime is paramount, and OT’s concept of uptime is often stricter than IT’s. That means implementing cybersecurity solutions for power generation is not as simple as installing the newest security appliance on the market. To accomplish this, OT teams typically take a different approach:
“Many solar organizations are meeting these challenges by optimizing around availability and uptime in parallel with security. Instead of focusing on endpoint cybersecurity solutions, the OT teams seeing the most success in their cybersecurity projects are focused on holistic solutions that include the network as well as endpoint solutions.”
For example, some teams are incorporating redundancy into their cybersecurity posture. In addition to the traditional defense-in-depth solutions they deploy, they are also creating redundant control schemas. The traditional tools help identify cyber threats, and when they do, redundancy helps the team get original systems back online without disrupting production and delivery.
Partnering for success
Today’s most successful power generators are also partnering closely with Emerson to help them identify their attack surfaces and develop mitigation strategies. Working closely with an expert automation vendor to perform vulnerability assessments helps teams identify areas of potential improvement while also helping them select mitigation solutions that do not interfere with their critical real-time controls.
But that assessment is only the beginning. Cybersecurity is not a set and forget solution. Many power providers work closely with Emerson to keep their cybersecurity solutions up to date, even as threats and technologies continue to evolve.
“Teams need to schedule regular checks of their security, monitoring both their endpoint and network security solutions, and monitoring software and protocols, to ensure they are up to date. The most experienced automation solution providers can be a single source of support for design, procurement, and management of the solutions that are best fit for an organization’s specific OT technologies, helping the team keep its cybersecurity investment evergreen across its lifecycle.”
Keeping up
The prevalence of solar is continuing to rise, but so too is the risk of cyber attack on critical infrastructure. Fortunately, as companies expand their generation capacity, the tools, software, and support exist to ensure their facilities are properly protected, and to maintain that protection as both technologies and cyber threats evolve.
