Cybersecurity, Reliability & CIP

“There are companies that are consistent and dedicated to reliability, and it shows. It comes out in the consistency of the improvement in their performance. That is what we’ve been talking about. You have to keep getting better.”

From the Large Public Power Council’s “Power Shift” meeting on Washington D.C.’s Capitol Hill, excerpts of remarks by U.S. Senator Kevin Cramer (R-ND), Omaha Public Power District CEO Javier Fernandez, LPPC Chair & Long Island Power Authority CEO Tom Falcone, and United States Energy Association CEO Mark Menezes.

“All Fusion Centers have access to relevant threat information that gets pushed out by the federal government, so I would highly encourage every utility to reach out to their Fusion Centers and see if there are ways they could partner with them on physical and cyber threats, if they aren’t doing so already.”

“Renewable power is at less risk if it’s on an installation behind a fence. Our fence provides security. That is why it’s attractive to utilities.”

“Nobody wants to touch a 20-year-old server, PLC, HMI or human machine interface, an engineering workstation in operational environment, and allow some computer or automated capability to block it. Putting automated detection and response capabilities in place for critical infrastructure is, for lack of a better term, critical.”

“We’ve worked cooperatively with states like Pennsylvania, New Jersey, Illinois, and Indiana that have strong cyber capacities within their respective public utility commissions.”

“We don’t necessarily have the regulatory mechanisms in place that allow the regulators to be able to evaluate assets that are designed for those low-frequency but high-impact events.”

“It is time for a win for rural electric cooperative members nationwide who wish to pursue flexible, innovative energy solutions.”

“What we expect is a lot of cyber policies will be litigated in court. It’s trying to figure out attribution, and attribution is difficult to prove.”

“Risk management in this space falls into three large buckets. First people, then process. Have we built an appropriate process that uses people and has sufficient oversight and controls? Then it’s technology.”