Home / Applications / Secure Operation

Secure Operation for Electric Power Utilities

Process Control Network and Plant Data Network Security Review: CASE HISTORY

Universal Dynamics has completed a security review for a major electric power utility company with 8,000 MW generation capacity and a transmission/distribution network serving 2 million customers. For the past few years, there has been a number of ongoing process automation and modernization programs employing intranet/internet technology at the customer's generation and power transmission distribution facilities. The growth of network traffic and expansion of the physical network infrastructure with a mixture of state-of-the-art and legacy installations created challenges in the implementation and enforcement of security measures. The security objectives are system/data integrity, availability and confidentiality.

The customer's existing corporate security policy was developed with the primary focus on corporate IS operation issues. However, security requirements for real-time process control networks and plant information systems have unique operation constraints and priorities. Security issues in a process control network environment are usually not well addressed with the same level of details as IS issues. The customer also discovered that it was very difficult to find external technical resources with expertise in both process control and IT background that understood the practical issues of an operating plant. The project team needed the technical knowledge on the equipment and technology employed in the process control network environment and operation. In addition, they also needed the IT knowledge in computer network protocols and communication technology to appreciate the system's security vulnerability and personnel safety issues.

Scope

The Universal Dynamics team was selected by the customer based on our team's diversified technological field of expertise in process control, power utilities and computer networking. The scope of review included the following major areas:

• Data Transport and Telecom Network fibre optic rings, microwave links
• Firewall, router management
• Non-destructive internal and external penetration tests
• SCADA, RTU systems
• Wireless control, remote signaling communication systems
• Turnkey, proprietary network subsystems - energy management, environmental monitoring, turbine controls
• Network communications with business partners and suppliers.
• Corporate network backbone infrastructure.
• Corporate security policy versus world best practice.

With the full cooperation of the system owners, the Universal Dynamics security review team conducted analysis of each system. The final report was presented to management on time and on budget. Existing security weaknesses were identified for further action and, more importantly, creative ideas were generated to manage these security issues more effectively to meet long-term growth objectives. The Universal Dynamics project team consisted of a total of six engineers and systems analysts for a duration of two months with half of the time spent on site.

Benefits

Several potential security issues were identified, and technical and procedural countermeasures were established to mitigate these risks. The customer's project team became more aware of the issues to be addressed in managing system security in a very dynamic environment.

The security review helped the customer become more familiar with the system's security characteristics and requirements to properly configure the most effective and appropriate protection necessary to improve system/data integrity, availability and confidentiality.

In the future, the customer will be able to plan for infrastructure expansion with confidence in the security and reliability of their power operations.