Understanding NERC's Proposed Critical Infrastructure Protection Standard

摘要

Ensuring the security of critical infrastructure requires an approach that integrates security system engineering, network and cyberse-curity solutions, facility hardening, construction, and power grid architecture design and retrofits. Three key focus areas enable utilities to develop a strong security plan. The first area considers event correlation and situ-ational awareness. Utilities must recognize increased threats-internal and external-and develop responses that can be coordinated across the organization. Sources of external harm could include physical and cyber attacks, including spyware and other forms of malicious software. Threats don't always come from outside an organization, however, as internal threats can include disgruntled staff, sabotage, or data manipulation. The second area of focus for utility security is to review the point of convergence for information technology (IT), operational technology (OT), and other security systems. As information systems are increasingly deployed for utility management and grid operations, there is a growing need for these sometimes disparate systems to interconnect to protect against the growing threat matrix. Utilities must field robust network systems and install the cyber tools necessary to be able to detect and respond to threats before damage is done.