One of the greatest challenges around the world is convincing people (or companies, for that matter) to make changes they don’t want to invest in. Regardless of the state of the marketplace, change that comes with added costs is always a difficult sell. And if that change adds complexity to daily life, it becomes even more of a challenge.
In many cases, that resistance to change is overcome by regulation—if there are penalties for noncompliance, people tend to make changes. This is likely why we’re seeing regulations regarding cybersecurity preparedness start materializing around the power industry. Power generation is a critical capability, and as such, governments are keen on ensuring it is protected.
However, there is no need to wait for regulations to begin securing power assets. As Emily Affare explores in her recent article in Power magazine, resistance to implementing cybersecurity strategies for OT power assets can be overcome with another core strategy: collaboration. Emily explains,
“The journey to cybersecure operations is difficult—if not impossible—to walk alone. Collaboration is critical, and not just at any single level. OT teams must collaborate with their automation solutions providers to ensure they have the right layers of defense in place. Public and private institutions must collaborate to ensure everyone is better prepared to navigate the complexity of developing cybersecure operations. Power generators and distributors must collaborate with their staff to ensure that they create usable workflows. In addition, as the rise of artificial intelligence (AI) continues, everyone must better collaborate with tools that have the potential to both help, or sometimes hinder, power delivery.”
Professional guidance
Automation solution providers are primarily focused on delivering the newest technologies to drive increased performance and safer, more efficient operation. However, the success of a partnership with a solution provider cannot be measured solely by the performance gained after implementing a new technology. OT teams should always evaluate the cybersecurity posture of their solution providers. Do their core partners offer holistic, fit-for-purpose cybersecurity solutions designed for real-time control environments?
Not sure what cybersecurity capabilities your automation solutions provider has? Emily details a great place to start:
“The best automation solution providers should also be able to demonstrate comprehensive cybersecurity certification, such as the International Society of Automation 62443 secure development lifecycle and Homeland Security certifications, to ensure their expertise. Moreover, the providers should offer OT teams cybersecurity playbooks and a wide variety of whitepapers applicable to requirements and implementation of cybersecurity services, both to provide continual guidance and to demonstrate expertise and continual evolution.”
Building buy-in
Even the best cybersecurity solutions struggle when implemented poorly or left unmonitored and unmaintained. As Emily explains, organizations must not only implement quality cybersecurity solutions, but also help their users understand them. Training is a critical part of helping users navigate new cybersecurity solutions—and that training should include helping them understand why they should operate in a cybersecure manner, not just how.
Moreover, organizations should prioritize implementing systems that don’t make OT work more complicated or risky. Software solutions with intuitive patching systems, for example,
“provide the user with controls to ensure there are no operational surprises, such as machines rebooting unexpectedly during updates. They can also make sure the processes of updates—such as antivirus definition updates—are not just smooth but also validated and fully tested before deployment so there are no surprises.”
If operators and technicians are not afraid that using cybersecurity strategies will break their critical systems, they will be far more likely to adopt the new workflows necessary to make such solutions work.
Collaboration comes in many forms
Emily shares a number of other strategies for creating collaboration that supports cybersecurity, including the importance of public/private partnerships in setting goals and standards. She also explores the way that AI is shaping the cybersecurity landscape—both how it more rapidly increases risk and threat levels, and how new AI tools can help combat bad actors. Learn all about it by reading the article in full over at Power magazine.
