Microgrids are distributed energy systems that include power generation and storage assets. They are increasingly being implemented to achieve one or more energy goals: reducing costs, increasing resilience or providing sustainable energy. Protecting these assets and your overall energy systems from cybersecurity attacks should be front and center. As a full-solution energy provider, FTI has a strong focus on cybersecurity for our customers and ourselves. While no product is completely immune from cyber incidents in today’s world, there are important investments in people, processes and technology that should be made to help defend against relentless attacks.
Secure Architecture
When looking at a defense in depth strategy, perimeter protection is one of many layers. Perimeter devices need to be rugged to support conditions such as harsh weather. As part of the perimeter defense, firewalls should be leveraged to apply policies on traffic, understanding what traffic is truly trusted and what traffic isn’t. The ability to provide secure remote management is crucial to ensure only approved individuals can access internal microgrid components. Separate networks are another key component of a secure architecture. When we consider PLCs, meters, inverters, batteries, internet facing traffic and IoT traffic, it’s important to understand what systems should interact, which ultimately adds layered protection via segmentation.
Solution Hardening and Patching
Device hardening along with applying software and firmware updates are good cyber hygiene. When devices are hardened it improves their ability to withstand a cyber attack. Ultimately it reduces the “attack surface” by eliminating unnecessary components or functions, which then reduces cybercriminals’ likelihood of breaching the system. Updating software is also important as that fixes bugs, often referred to as vulnerabilities, within a product. Applications and operating systems need patches applied on an ongoing basis. Firmware updates are another component to keep in mind, which may also have bugs or vulnerabilities that should be addressed.
Comprehensive Training
Providing operational technology (OT), industrial control system (ICS) and general security awareness training is fundamental for those involved in microgrid installations. Securing operational technologies can have additional challenges that should be addressed, and training individuals who have roles and responsibilities for implementing microgrids is key. The ability to prevent incidents from happening is another type of training called security awareness. More and more cyber criminals are reverting to social engineering attacks where they look to obtain information such as IDs and passwords that can compromise a network or functionality within a microgrid solution.
Security Testing
Testing comes in many forms to meet many different use cases. As a microgrid is deployed, various security controls are present and should be validated to operate correctly during factory acceptance and site acceptance testing. Documented procedures are needed for testing all changes for security impacts. This includes incident response plans on how to handle incident preparation, detection and analysis, containment, eradication and recovery, along with post incident activity. Security testing can also come in the form of trained professionals who perform security assessments and penetration tests. The output of a penetration test can close gaps or weaknesses defined in a solution with the goal of protecting your investments.
Conclusion
Good cyber hygiene and practices will help ensure that the energy goals of your microgrid – reducing costs, increasing resilience, and/or providing sustainable energy – are met. FTI can support you with full-solution cyber security systems and practices to help mitigate cyber threats – contact us today.
If you enjoyed this blog article, please subscribe to stay up to date on the latest industry news from our experts at FTI.
