Calls for Enhanced Enterprise Security Governance Starting to Steamroll

Though I've been approaching this issue from a sector-specific perspective for years, lots of what's been in the news lately (and I mean lately) is intended for all technology-enabled sectors. Which pretty much means every business and every organization that intends to maintain consistent and reliable operations in the near and mid-term future.

First off, and with origins that predated the Target breach that's credited with generating most of this activity, was DOE's Energy Advisory Committee giving thumbs up in May to a paper on this topic on Security Governance. It proposes that DOE pursue potential upgrades to how energy companies organize and run themselves from a security perspective. Titled: EAC Recommendations for DOE Action Regarding Implementing Effective Enterprise Security Governance - Outline for Energy Sector Executives and Boards, among other things, this paper lists the following "Characteristics of Effective Security Governance":

• Clearly defined responsibilities from the board of directors to senior leadership to employees 
• Presence of an active Security Governance board comprised of senior stakeholders from across 
• the company 
• An executive owner of enterprise security: with purview over IT, OT and physical security policy designated CSO or similar 
• Striving for 100% alignment with of security with business/mission 
• Using measurement of key indicators to increase awareness and drive improvement (with 
• maturity tools like DOE's ES-C2M2) 

Where do Today's Electric Utility CEOs come from, and what do their Origins Mean for Grid Security?

I remember once thinking, naively perhaps, that most utility CEOs must have come up through the ranks, like generals in the military, with hands-on operational engineering experience garnering them the respect of their peers and subordinates along the way.

When I shared that concept last year with a 40-year industry veteran who'd done his time in generation and T&D, he schooled me saying that while that used to be the case, it's not the norm today.  He said more often you'll find someone with a finance background, often imported from sectors outside power.

Thoughts on "Risk and Responsibility in a Hyperconnected World"

Hat tip to Tim Dierking of Aclara for spotting and forwarding this January 2014 World Economic Forum / McKinsey report: "Risk and Responsibility in a Hyper-connected World." Tim pointed to a couple of excellent sections on cyber resilience and future scenarios which you'll find within, but I'm going to call out a different selection for your immediate consumption.

This below is taken directly from the McKinsey summary, which while not energy-sector specific, is right on the money, IMHO, on the culture, leadership and organizational dynamics aspects of what's needed to do security right in 2014+.  Here you go:

A CEO-level issue 

Given the trillions of dollars in play, the stakes are high. And given the range of social and business issues that cyber resiliency affects—for example, intellectual property, regulatory compliance, privacy, customer experience, product development, business continuity, legal jurisdiction—it can only be addressed effectively with active engagement from the most senior business and public leaders. 

Singer & Brookings on the Security Governance/Ownership Vacuum

Analyst and author Peter Singer of the Brookings Institute has a new book out intended for everyman. And everywoman. To include particularly those types who consider themselves non technical, or as I've heard cyber folks in DOD refer to them - tech immigrants (vs. typically younger tech natives).

The net he casts is wide enough to captures senior government and business leaders too.  Below are excerpts from a recent interview with CNN/Fortune that really resonated with me, with particular applicability to our sector:

"Stop looking for others to solve it for you, stop looking for silver bullet solutions, and stop ignoring it." 

Conference Alert: EnergySec and NESCO Town Hall next Week

Ok, so usually I'm giving a heads-up about some conference or seminar you might want to know about, or even attend. But this time I'm saying that, but also revealing I'll be there too.

And I note, in the town where Peyton Manning recently threw 7 TD passes in one game and one can easily procure Rocky Mountain Oysters, I'll be joining luminaries from industry and a number of utilities too.

Here are the deets:

• Where: Magnolia Hotel, Denver, CO
• When: 17 - 19 September, 2013
• What: Lots of stuff. Agenda HERE
• How: Easy. You can still register HERE

For your edutainment, I'll be moderating a town hall style discussion about the current state and future of the cyber security workforce in the energy sector. We'll be considering full life (as in human life) cycle issues, from birth to tablet training, from kindergarten to college curriculum, from entry level security practitioners to ICS forensics wizards and all the way up the managerial stack to CSOs and CISOs.

Hope to break some new ground and capture some new ideas we can share with all and will do here on the SGSB during and/or right after. Will also tweet whenever possible using the hashtag #ess13.

Hope to see some of you there!

Photo credit: Daily Mail online

The Things I've Seen Series: Part 2 - Execs Exempted

Last week I posted on an encouraging trend I witnessed over the past 2 years: the emergence in some utilities of security governance boards comprised of security and privacy leaders, often a rep from legal or compliance, and senior stakeholders representing different business lines.  Soon after it went live, I received multiple corroborations from friends in the field who have seen the same thing in their patches. This is all goodness.

But there are other, less uplifting trends you should be aware of if you're not already. I've seen senior executives who have not once met with their cybersecurity leaders and who feel they have no reason to do so. I've had senior state regulators tell me that they haven't really thought about cybersecurity until very recently. 

Declaration of Independence and Intent

I've been warming up and working in this space for years now, and if you've been a Smart Grid Security blog subscriber or an intermittent visitor, you may have noticed an evolution in cyber security thinking of sorts. Well, with changing the world as my goal, it's time to stop treading water and start swimming like I mean it. I just left IBM in order to bring a new type of security advisory service to energy sector organizations. Here’s a brief version of the concept:

You often hear that culture change is the hardest thing to accomplish in an organization. That may be, but to help put our sector’s cybersecurity preparations on a better course, I’m developing an approach focused on increasing organizational awareness and improving internal communications about the security issues that matter. It begins with senior leadership, extends throughout the enterprise and doesn’t stop until it reaches service providers and the supply chain. Most engagements will begin with an in-depth orientation briefing for senior stakeholders, followed by periodic meetings and dedicated hours of access so that I can be a resource whenever my input is needed.

Energy sector can learn from DOD's cybersecurity strengths (and weaknesses)

Last year the US DoD released a report by one of its Defense Science Board teams and I've seen it referenced a number of times in recent weeks, especially in articles announcing our loss of the most sensitive systems design details on dozens of current and next generation weapons systems.

See if you think this excerpt from the executive summary would accurately describe the current state at the utility you work for, or regulate, or invest in, or power your home with:

[The conclusion that we must do much better on cyber defense] was developed upon several factors, including the success adversaries have had penetrating our networks; the relative ease that our Red Teams have in disrupting, or completely beating, our forces in exercises using exploits available on the Internet; and the weak cyber hygiene position of DoD networks and systems.

If you think it might, then it's possible that you may find value in digging into the findings and recommendations within. I noticed this one on culture as being particularly relevant to our sector:

Individual and organizational cyber practices result in so many cyber security breaches that many experts believe that DoD networks can never be secure with the current cyber culture. The individual’s immersion in the civil sector cyber culture and the military’s focus on mission objective are the two most important contributors to DoD’s poor cyber culture. In the face of a threat that routinely exploits organizational and personal flaws, DoD leadership must develop a clear vision for the Department’s cyber culture.

It's very likely your utility is not targeted nearly as much as are the DoD's networks and systems, but I'd still say this report has lots of applicability for the way we think and act.

-------------------------

URL for full report:

http://www.acq.osd.mil/dsb/reports/ResilientMilitarySystems.CyberThreat.pdf

More Datapoints on the Current State of Electric Sector Cybersecurity Governance

In March we covered the preliminary CyLab report on the state of cross sector Security governance and one of the things it taught me was that electric sector cybersecurity professionals are not alone in their quest to improve/increase the level of interaction and communication with senior executives in their companies, including the CEO and Board of Directors (BoD).

Other than financial services sector companies, whose reputation for being in the lead on security and privacy governance matters is corroborated, none of the other sectors covered (IT/Telecom, Energy/Utilities, Industrial) fares particularly well.

Well, the final Carnegie Mellon/CyLab report is out now, and it provides a lot more detail into which to sink one's teeth. You can begin with the press release HERE, or move straight into the 28-page full report HERE.

But with your limited time in mind, electric sector reader, I've cherry picked a few salient nuggets for your more rapid consumption. First, an opening statement:

Interestingly, none of the energy/utilities sector respondents indicated that they have a Chief Risk Officer (CRO) even though their risks are high. The energy/utilities sector also places a much lower value on board member IT though their risks are high. The energy/utilities sector also places a much lower value on board member IT experience than the other sectors, which is puzzling since their operations are so dependent upon complex experience than the other sectors, which is puzzling since their operations are so dependent upon complex supervisory control and data acquisition (SCADA) systems.

Interesting: connecting IT experience with a foundation for grasping control systems security fundamentals. Certainly better than having no information systems background. And I didn't know CRO's where rare in large utilities. Maybe the utilities that participated in this survey are not representative of the larger population for some reason. But I would have thought CROs were commonplace, even if their attention wasn't trained on cybersecurity risks.

Now lets go straightaway to electric sector conclusions:

• The energy/utilities and IT/telecom respondents indicated that their organizations never rely upon insurance brokers to provide outside risk expertise, while the industrials sector relies upon them 100%
• Energy/utilities and IT/telecom sector boards are not adequately reviewing cyber insurance coverage
• The energy/utilities sector places a much lower value on board member IT experience than financial, IT/telecom, and industrials industry sectors

And let's conclude with this recommendation, since it squares so nicely with one of the oft-repeated themes of this blog:

Review existing top-level policies to create a culture of security and respect for privacy

This CyLab report is an interesting complement to the recently release IBM CISO Survey, the results of which were discussed HERE last month. I'm always glad to add others' takes on how our sector is faring, even if the findingss are less than glowing. The truth, as they say, and presuming it's present to some degree in these reports, will set you free. Hopefully free to make things better.

Image credit: Magnetbox at Flickr.com

Announcing the First Electric Sector CSO List

You've been holding your breath for this, I know, so I'm happy to announce you can resume normal respirational activities. As the title says, this post begins the process of assigning kudos to utilities who've been so bold and proactive as to appoint and empower a senior professional to run cyber security across their organizations.

By this I mean a senior business (more than a technical) professional charged with developing, promulgating and enforcing security policy across operational and information technology boundaries, across all lines of business.

Economist on Data Breaches in US and Europe: As Always, Leadership is What's Needed

I've brought The Economist into the SGSB fray before and I'll do so again now.  There's a short piece just posted on one of their online nodes that talks about two recent studies on data loss and how it might best be averted.

Here's an excerpt:

[Out of 600 European businesses surveyed] more than half thought that technology can solve the problem. Only 1% of the businesses surveyed believed it concerned all employees—and thus required a change in behavior. 

I'm no technophobe, but neither am I a technophile, at least not from a cybersecurity point of view. For me the lion's share of the most effective security and privacy solutions focuses on the humans, and one particular type of human is a must if we're ever going to get in front of these problems: the leader.

Symantec’s study found a correlation between having a senior executive in charge of information security and lower costs of data breaches. “It has to start at the top,” says Marc Duale, Iron Mountain’s head. 

You can read the whole thing HERE ... it's pretty short, and makes an interesting comparison between American and European approaches.

Photo credit: SteFou! on Flickr.com

Smart Grid Security Blogger: Unplugged, Rebooted and Recharged

If the post from a few weeks ago called Generating Leaders was about why we send kids to camp (and how society benefits), then this one is about why I/we send ourselves away sometimes. I don't want to waste your time with extraneous personal details, but will share a few takeaways re: the purpose and benefits of taking these periodic time outs.

And in my case at least, as with the traditional summer camp experience in the US, my best time away involves deep, cell-phone-free immersion in nature with a few close friends, and pushing myself physically in ways I can't during everyday life.

In the aforementioned post on kids and camp, I called out the following ingredients:

• A change of scenery
• New experiences & new skills development
• Connections with the past
• Dis-connection with the techno present
• Time alone and time together
• Encountering and connecting with other kids from other cultures
• Big fun

Not all these line up perfectly with my recent experience (unless you count what happens when Bostonians meet Texans as a cross-cultural encounter). But even for a near grown-up like myself, the similarities are many.

First of all, in the chaos of what constitutes a normal day and night as a full time IBMer + blogger + parent, I'm not sure the static and cross-talk going on in my grey matter could really be called thinking. It's certainly not deep thinking in any sense. But several things happen on these hikes that seem to help. The first is sleeping and waking in near total silence. Related, but on the visual front, is the complete lack of illuminated screens in the mountains. There's nothing to catch your gaze outside scenes of the most natural beauty, lit by only ambient light (see: Sun, Moon, Stars). Lastly, there's pushing my body hard enough that things start to quiet down between my ears, which creates a space for really thinking.

For construction workers, miners, linemen, and anyone else who does hard physical work for a living, trips like these may be redundant. Though likely not in the most serene surroundings, they already do hard work with their bodies day-to-day and that brings a certain stillness. But for sedentary folks like me and probably you (aka knowledge workers), tuning in to the world from a chair surrounded by LCD monitors and more than 1 phone makes concentration a scarce and precious commodity. Disconnected on remote trails, humping heavy backpacks up switchbacks and over passes above 12,000 feet, the mind quiets down and then turns on in a different and better way. Back at home in Boston now, I can still feel the difference.

There are other ways to achieve a similar effect, of course. And some are much simpler, logistically speaking. But for me, at least once a year, nothing beats a trip to the mountains. It's been Colorado lately, but I can hear the Alps calling.

So, since you made it this far, here's an aerial shot of the Four Pass Loop ... we did the 30+ miles in about 3 days. Some go slower, some go faster:

Four Pass Loop - click to enlarge

Here's a picture taken last week after crossing and coming down from the fourth pass in the Snowmass/Maroon Bells region:

And speaking of Snowmass (Old Snowmass, that is), look who my son Dylan and my friend Chris and I ran into the day after we re-entered civilization:

If you know energy efficiency and renewable energy, then you know that's Amory Lovins, founder of the Rocky Mountain Institute (RMI). We had the great fortune of spending time with him at his private residence and energy efficiency test bed, which you can read more about HERE.

All in all, a smashing success on many levels. I'm going to use the clarity I gained in my day job and on the blogs for as long as I can keep it. And as to the last item on the camper list ... you bet it was fun.

A Controlling Interest in Securing Utility Control Systems

Energy and utilities control system cyber security expert and firebrand Joe Weiss is making waves again, this time via an interview with CNET in which he describes the current state of progress (and its lack) in this most essential yet often overlooked Smart Grid domain. You see, when word got out that the previously tech-averse utilities were stirring thanks to this thing called the Smart Grid, IT and IT security professionals rushed to sell their services and wares to utilities' IT shops.

Little did they know (and some still don't) that they can market Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Single Sign On (SSO), application firewalls, database security, pen testing and application security testing tools, not to mention NERC CIP compliance tracking and reporting systems and more ... till the cows come home, and still leave their utility customers, and their portion of the Smart Grid, woefully unprotected.

That's because of the other side of the house. You can call it field operations, or use an acronym like Operational Technology (OT); either way, it's a place where IT professionals fear to tread. And because of organizational culture reasons and the fact that SCADA-based operational systems are so unlike standard IT systems, the IT guys (vendors and utility employees alike) are generally unwelcome outside IT.

Weiss, a one man army, has been trying to get this message out to government and industry decision makers for years and is starting to make some significant inroads. Here's an excerpt from the CNET piece, though we highly recommend you read it all:

[A] utility's human resources network or their customer information networks are more cybersecure than any power plant, including nuclear, any substation, or any control center in the U.S. [Why?] Because the utilities got together and came up with a set of criteria, called the NERC critical infrastructure protection (CIP) standards. In those standards they input a number of exclusions and allowed them to self-define what would be "critical." NERC has put out emergency warnings on some of the areas that have been excluded, like telecommunications, but NERC CIPs specifically exclude them. Can you imagine doing a cyber assessment of your IT systems and being told "do not address telecom?" Because of the Energy Policy Act of 2005, electric distribution which is the heart of the smart grid is specifically excluded even though the electrons move from distribution to transmission and back. It simply doesn't make any sense.

Here's the full CNET Q&A. And while you're at it, you should read Forrester's take on the CNET-Weiss interview here. It's a little bit utopian in places, but it reminds us that we've been dealing with control systems security for years in other industries, and we like the emphasis on people vs. technology for a change, like here:

Deploying smart technologies is not enough. Take time to redefine existing processes and invest in people’s skills and education. You should invest the time and energy in marketing security and risk measures when deploying smart cities and smarter grids from day one.

Of course, the people Forrester is talking about dwell in both sides of the utility house. And if Joe Weiss had his way, there'd be more of an open floor plan, with security planning and implementation discussions reaching both IT and operations, and vendors and utility professionals alike understanding that their job's not done until they've secured the whole enchilada.

For more SGSB coverage of Joe's work, click here.

Photo Credit: George Campbell on Flickr.com