Utilities need a new way to secure the grid. Here’s why Zero Trust is the way forward.

In 2021, Colonial Pipeline was hit by the largest cyber-attack on an oil infrastructure target in U.S. history. Carried out by the DarkSide hacker group, the attack forced Colonial Pipeline to temporarily shut down operations and led President Biden to declare a state of emergency.

This kind of incident is far from a one-off.

Energy companies, including utilities, are increasingly targeted by cyber-attacks — and the hard reality is that the security measures of old are nowhere near robust enough to cope with the complexity of today’s threats.

What can utilities do to defend themselves?

We discussed that topic in a recent webinar that covered:

• The nature of modern cyber-attacks
• Why traditional security measures are no longer sufficient
• How a Zero Trust security model offers an essential upgrade
• The benefits of our GridOS® Zero Trust grid security model

Listen to the webinar to learn how to fortify connectivity for today and tomorrow's distributed workforce with a model built-in not bolted on to protect resources from inside and outside threats. Keep reading for a summary of the discussion.

Consider these scenarios:

A hacker exploits a vulnerability in an EV charging station. A grid worker opens a legitimate-sounding email containing a trojan horse. A cyber group smuggles malicious code into a control room software patch.

As the grid becomes increasingly digitalized and connected, these kinds of scenarios become part of the modern reality. From a simple employee error to a coordinated nation-state attack — cyber threats from both inside and outside an organization come with the potential of bringing down the grid.

In such a complex, unpredictable environment, what’s the best way forward?

In the recent past, organizations relied on a castle-and-moat security model. This approach is rooted in the idea that only people outside an organization pose a threat, not people on the inside.

But it’s an approach with a fatal flaw: how can you that know a person who’s made their way into the castle walls is who they say they are, and hasn’t been a victim of identity theft? How do you know even previously trusted users aren’t trying to break into other places, or overstaying their welcome?

This implicit trust security model is too archaic to cope with today’s threats. If your network isn’t vigilant enough, hostile users can force their way through your systems or threaten your ‘trusted’ users to carry out a hack against their will.

Put simply, we need a smarter approach to cybersecurity.

You’ve probably heard about Zero Trust grid security before. As the name implies, it’s an approach that assumes everyone and everything is a potential threat. That includes clients, networks, software, vendors, and even regular users. No one is trusted, pure and simple.

Unlike perimeter-based security, Zero Trust grid security architecture can also be adjusted to handle emerging threats. It’s dynamic and adaptable in a way that traditional security approaches are not.

Put simply, Zero Trust grid security is nothing short of crucial as the grid connects to an expanding (and less predictable) ecosystem of DERs, EVs, cloud networks, and connected digital workforces.

At GE Vernova, Zero Trust grid security principles come built into GridOS®.

GridOS is the first software portfolio designed specifically for grid orchestration, and it gives utilities the capabilities to combat potential threats in a way the modern grid demands. Here are some of the ways its built-in Zero Trust grid security principles can defend your utility:

• Don’t trust the Identity: Using built-in multi-factor authentication, users are forced to ‘prove’ their identity before accessing your systems. There’s no way someone can masquerade as another user.
• Don’t trust the Person: Customizable permissions let you limit access to your systems in a highly granular way. For instance, you can add thresholds to certain job roles that cap their access to critical operations (and can only be reset by an approved internal gatekeeper).
• Don’t trust the Client: Stolen client devices (from tablets to mobiles) offer malicious actors a route into your network. By applying Zero Trust grid security principles, GridOS checks the client is who they say they are (via a validated certificate) and ensures the server is secure.
• Don’t trust the Delivery: Malicious packages can also be smuggled in via trusted vendors, such as through software updates. But GridOS can act as a single trusted channel — allowing you to validate external software and then shut it down if it acts suspiciously once inside your network.

Cyber-attacks on the grid are too complex to be dealt with by traditional perimeter-based security. In the coming years, rising DERs penetration will grant threat actors with an ever-expanding attack surface to exploit vulnerabilities. While supply chain disruption, disgruntled employees sharing security data, and simple human error will all require ongoing vigilance.

For utilities, a Zero Trust grid security model is an essential next step to combat these threats — and provide the confidence to safely expand their capabilities.

To find out more about GridOS and its Zero Trust grid security principles, take a listen to our webinar.