Staff Reporter

In the US and even globally there is an increasing emphasis on improving the cyber security of the systems and components controlling such things as electric substations, control centers, gas pipelines, and the associated Supervisory Control and Data Acquisition (SCADA) systems. As an active observer of this industry for many years I can say that the cyber security of these systems is improving; however, there is a new gap or omission brewing. We are often asked to perform security assessments for energy and utility companies. As we do work at some customer sites we are continuing to note that the emphasis on cyber is certainly in place; however, the physical security of the infrastructure is being ignored. What we are concluding is a holistic security program is missing at some of these companies. What do I mean by holistic? Essentially holistic security is concerned with the whole security environment in an organization rather than simply focusing on single elements such as cyber, physical, administrative or technical security. In other words, security is viewed as a collection of interconnected and coordinated functions to protect assets and maintain reliability. Why is the holistic emphasis missing? The history of security for energy and utility enterprises has primarily been focused on “guns, gates and guards” until around 2008. Overall the security focus was really a military of police mindset. Cyber was very rarely considered. After 2008, in the United States and North America, the North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standards were published and enforcement began with emphasis on protection of critical cyber assets that are important to the reliability of the bulk electric system. The enforcement included inspections and fines for non-compliance. A new emphasis on cyber security emerged; and as a result physical security was placed in a lower echelon. The observation we offer is based on our own experiences in the field. For instance, we see the singular focus on cyber at various global utilities we inspect. We have seen examples of where physical security is in decline and not being address at substations and generation facilities, including: External doors and locks are not adequately protected. There are gaps between the doors and door frames and the lock assemblies are not protected with simple metal plates. In several cases we’ve been able to open doors with simple plastic credit cards and gain access to critical cyber assets and copper. Door hinges are on the outside of the door frame. Because of this practice it would be easy to unscrew the hinges then simply lift the door out of the frame. Control building perimeters have unprotected windows in doors and walls. We’ve seen windows in doors that could simply be broken physically and then the door opened by reaching inside through the window break.