Peter M. Curtis - Maintaining Mission Critical Systems in a 24/7 Environment

From even a cursory review of the challenges faced by today’s electrical grid, it is clear that a long‐term solution for our production, distribution, and security needs will require a synthesis of our modern digital, renewable, and power distribution technologies. The “Smart Grid” is one solution proposed to fit our needs. An initial step will be the introduction of “Smart Meters,” which will allow end‐users to closely monitor and control their energy usage, as well as sell back excess energy produced by on‐site renewable resources and generators. Such a digital system, when integrated on a large scale, will allow utilities to more efficiently produce power and provide it where it is needed, as well as help decrease the frequency and severity of outages.

Energy security has serious repercussions for mission critical facilities. If the power isn’t flowing, business comes to a screeching halt. While improving our energy security is a national /global imperative, facility owners and managers also have the obligation of taking steps to ensure the continued operation and success of their businesses. This may manifest itself in many different ways, through improving physical and cyber security, decreasing reliance on the electrical grid, improving employee training to decrease the occurrence of preventable service outages, and developing an effective disaster recovery plan.

The security of all of these networks is the subject of urgent, on‐going assessment. Much of the analysis has been focused on physical and cyber security – protecting the physical structures themselves, or the computers that are used to control them. But their greatest vulnerability is the loss of power upon which every aspect of their control and operation ultimately depends. While the multiple layers of the utility’s critical infrastructure are highly interdependent, electric power is, more often than not, the prime mover – the key enabler of all the others.

However, in the past, the energy industry has not typically been focused on information security risks and has been even less concerned about privacy. Equipment failures due to information security vulnerabilities are not usually anticipated, and except for an acknowledgment of damage caused by data theft, the exploitation of those vulnerabilities is not usually seen as a likely cause of catastrophic events. The root cause of the August 2003 Northeast Blackout is listed as “Human decisions by various organizations, corporate and industry policy deficiencies, and inadequate management;” proper policies backed by strong information security measures is part of the solution as well as solid training programs that include refreshment courses of emergency action, alarm response, and standard operating procedures.

According to the Federal Energy Regulatory Commission, both domestic and foreign hackers are now devoting considerable time and capital to mapping the technology infrastructures of companies. The network exploitation done to explore a network and map it has to be done whether the intruder is going to steal information, bring the network down, or corrupt data. Information security experts believe that this may be the cause of a few recent major blackouts.

Hackers are like digital spies with the ability to steal information or disrupt networks remotely. Officials need to be more aware of security breaches, as they are a national/global security issue. The intellectual capital and industrial secrets are at risk and keeping the risks quiet only makes the situation worse. The private sector, which owns most information networks that operate power plants, dams, and other critical infrastructures, needs to do more to improve security and protect critical data. A cyber‐attack could disrupt critical operations and impact customers.

The Smart Grid, being a digital system, would be vulnerable to cyber‐attacks. The sector evolves with the emergence of Smart Grids, connected to other systems such as SCADAs, IoT…etc. They require greater security monitoring since they are the entry point for cyber criminals. The combination of Information Technology (IT), Operational Technology (OT) and Internet‐of‐Things (IoT) are access gates for cyber criminals. Therefore, there is an urgent need for effective strategies in order to secure Smart Grids against cyber‐attacks. To address this hazard, recommendations have been made to build the Smart Grid from the ground up with security in mind. Some of the governing standards to address cyber security within the bulk electric power grid are the NERC suite of Critical Infrastructure Protection standards (CIP‐001 thru ‐014), Smart grid information security (IEEE 1686, P37.240, IEEE 1402, IEC‐61850). An intelligent system would be able to detect intrusions and bypass affected nodes to keep electricity flowing to consumers. This capacity to “heal” through the use of installed “smart” switches throughout the network would create a grid that is more resilient to deliberate attacks and natural disasters.

How do power outages relate to the level of reliability your company requires from an energy standpoint? Facilities can generally be classified by Tiers, with Tier I being the most basic, and Tier IV being the most reliable facility. The reason for having different tiers is due in large part to maintainability, i.e., maintaining the facility without shutting it down. Tiers I and II must be shut down to perform maintenance; Tiers III and IV are deemed “concurrently maintainable.” Critical functions will usually require a facility in the Tier III to Tier IV range or utilize other strategies such as co‐location. Although rare, it is possible that critical business functions will be located in a Tier II or even a Tier I facility configuration, despite the fact that both lack full backup and redundancy support. This practice is not encouraged. Figure 2.4below identifies types of electric load interruptions associated with recent significant power outages shown in Table 2.1.

Figure 2.4 Potential Causes of Load Interruption or Downtime

Figure 2.5The Tiers of the Electric Grid from Generation to Chip. Derived from “Distributed Energy resources interconnections systems” U.S.DOE NREL (September 2002).

Table 2.1 Recent Significant Power Outages (Various Sources – Google Alert – Major Power Outages)

In fact, the energy industry is just coming of age to utilize the latest operation technology. Some organizations lack even accurate and up‐to‐date information to provide first responders of grid outages with the intelligence and support necessary to make informed decisions during critical events. Keeping personnel motivated, trained, and ready to respond to emergencies is a challenge, made even greater without an appropriate records retrieval program in place.