#BIDEN 100 DAY PLAN GENERATOR#

Regardless of what best practice recommendations or regulatory standards come out of the administrationвЂ™s 100-day sprint, Small says that, ultimately, it will be up to the private entities that own and operate power generation facilities to take the steps necessary to cyber-secure this infrastructure and that will begin with changing how they view security in general. There are only so many suppliers they can buy control systems from and I think the manufacturers of those products need to be part of the conversation as well.вЂќ The Role of Utilities вЂњYou can fix these problems with mitigating controls and there are lots of things you can do, but the producers canвЂ™t go it alone.

вЂњA lot of the problems energy producers have in protecting these critical assets is because there is out of date software, old equipment that is no longer supported and so on and so forth,вЂќ Small says. In addition, Small says the OEMs that supply industrial control systems must be a part of this conversation as well. Of course, this is done on a more local level through states and municipalities, but Small explains that it is still a big part of the overall equation when it comes to securing the grid. While the current plan takes the generation and transmission of bulk power into consideration, Small says one thing it fails to account for is the third part of the nationвЂ™s electrical grid which is distribution.

вЂњThe threat landscape has changed, but in some cases our technical defenses have not.вЂќ What the Plan Misses We didnвЂ™t have that 20 years ago,вЂќ Small explains. вЂњThat allows for the possibility of attacks to come from another network, specifically the internet. Ironically, todayвЂ™s desire by organizations to leverage data from all sources at their disposal that has given rise to the Internet of Things (IoT) has also meant that industrial controls systems вЂ“ once completely separated from the internet and corporate networks вЂ“ are now being increasingly interfaced with information technology systems and thus giving them greater exposure to attack. Of greater concern, though, are targeted attacks against infrastructure, such as those carried out by sophisticated cyber-attackers or nation-state actors Г la the Stuxnet worm that targeted supervisory control and data acquisition (SCADA) systems to cripple Iranian nuclear ambitions a decade ago.

#BIDEN 100 DAY PLAN GENERATOR#

Rather than just using an executive order to say, вЂhey, protect our infrastructure,вЂ™ the administration is soliciting comments from the generator themselves, so hopefully this will be a more collaborative approach than previous efforts, although it is still ambitious,вЂќ Small explains.ДЄmong the biggest threats facing the grid currently, according to Small, are unauthorized users and malicious software, particularly ransomware which has become an increasingly popular tool for cyber criminals to extort a wide range of industries. вЂњThe administration is asking for input from the power generators themselves, so I think that is a positive sign. While previous administrations have been made aware of the threats facing the grid, few have taken concrete steps to address these systemic challenges, however according to Damon Small, MSc.IA, CISSP, Technical Director of Security Consulting at NCC Group North America, the fact that the Biden administration is requesting information from utilities about cybersecurity vulnerabilities as opposed to making blanket directives is a good thing. The longer-term benefit which will accrue is increased detection capabilities which will reinforce that trust over the longer term.' вЂњThe first is showing the government is aware of the challenges and is doing something. вЂњThe 100-day sprint is meant to accomplish two things: 1) establish public trust in our electric grid 2) create a roadmap for a more robust plan,вЂќ explains Bryson Bort, CEO of adversary emulation platform provider SCYTHE. In a statement, the White House said that the plan, which is a coordinated effort between the Department of Energy, private utility operators and the Cybersecurity and Infrastructure Security Agency (CISA), will include вЂњaggressive but achievable milestonesвЂќ and will help the industry when it comes to enhancing cyber detection, mitigation, and forensic capabilities.Дetails about the plan remain scant but cybersecurity experts believe it is certainly a step in the right direction. Last month, the Biden administration announced the roll out of a 100-day plan aimed at improving cybersecurity protections around the nationвЂ™s electrical grid.

Biden 100 day plan