Utilities across the country are at risk of cyberattacks and Black & Veatch, thanks to a new partnership with Idaho National Laboratory (INL), has a method to diminish the threat.
The INL licensed its patent-pending methodology, which is designed to improve security within the nation's utility infrastructure, to Black & Veatch, said Mike Prescher, a senior cybersecurity and network architect at the Overland Park-based company.
“There’s a whole panoply of attacks and sabotage that’s been happening in critical infrastructure for years, but the general public, for the most part, doesn’t hear about it,” Prescher said.
The partnership will expand Black & Veatch’s services to offer proven information security posture enhancement services for operational technology systems, which are the most vulnerable to cyberattack. By using INL’s capabilities in utility security technology, the service offering moves cybersecurity beyond perimeter protections and related technologies into a deeper examination of people, processes and technology within operational technology environments.
It aims to minimize the risk of cyber-enabled sabotage of critical business functions and the impacts of ransomware and other emerging threats.
“INL goes beyond classic cyber hygiene protections, which are still important and don’t go away, but they add on top of it people, process and application use, which is what differentiates them,” Prescher said. “That is to say, now when BV goes to a customer for a cybersecurity assessment, if it is an INL engagement, not only will we take a look at their classic cyber hygiene: architecture, infrastructure, firewalls, access controls, etc.; but we’ll also talk to the individuals that actually handle the applications, understand precisely the application flow through the infrastructure and even look at the supply chain, which is pretty important.”
The cybersecurity experts will determine who accesses utility systems remotely, who has access to those systems that aren’t employees of the utility, whether those people are trained and what devices are being used and whether those devices are secure. Prescher said this is an involved process that can take months to complete.
“We’ve added this human factor to it,” he said. “We have to go talk to people.”
With free training as part of the partnership agreement with INL, Prescher said that he believes that INL is not offering the service to make money, but as a public service. INL has the knowledge, Prescher added, through its contacts with the federal government, about the state of the infrastructure as well as who the bad actors are.
Supported by DOE’s Office of Cybersecurity, Energy Security, and Emergency Response, the company's methodology addresses utility security inadequacies in four phases: consequence prioritization, system-of-systems analysis, consequence-based targeting and mitigations and protections.
“Every day, our utility clients face the very real threat of cyber intrusion, which can be devastating for critical infrastructure and the businesses and communities that rely on reliable service,” Joe Zhou, associate vice president and senior managing director of infrastructure modernization at Black & Veatch, said in the release. “Securing our infrastructure from unauthorized access and sabotage has grown to a top-level concern. Having access and training to apply this leading CCE methodology will ensure that we continue to lead our industry in providing top-level experts and advisors to achieve security requirements.”
The top-level concern, along with INL’s sense of urgency, Prescher said is well-placed.
“The time to accelerate a different adoption of a different methodology that is better at protecting critical infrastructure and differentiates from all the other frameworks is now,” Prescher said.
