Five Fundamentals for Building a Strong Cyber Program

Utilities are an integral part of our human society. Not only are they important, but they are expected. I believe when I flip on a light switch or turn on the faucet, my utility is going to function. When the lights go out, or toilets are unable to flush, it not only becomes an inconvenience, but given enough time it becomes an emergency.

Fortunately, the reliability and quality of our utilities has been a priority for municipal governments for many years. Great care has been put into the construction, maintenance, and protection of our utility systems.

But today the threats that face this landscape are changing. A new risk is evolving around the potential interruption to our utility, and that threat is to our technology.

I have worked in the Water Utility space for the last few years, but I have spent my entire IT career working in a regulatory IT environment. During this tenure, I have seen IT security go from making sure someone could not print or access a file, to making sure a nation-state could not use a missing patch to steal data or compromise a system—an action now labeled as a cyberattack.

Cyberattacks can occur in many forms with many different results. Today, I know the cyber threat is real; however, the level of risk falls into former Defense Secretary Donald Rumsfeld’s definition of an “unknown.”  What I do know is that over the last five years I have had to learn to re-educate myself as an IT leader. Today, my goal is to share with you the five steps of how I have adjusted my approach for cybersecurity.

1. First and foremost, I believe the most important step in developing a cyber program is to have a complete inventory of everything that is information technology related, and having this tracked in an asset management program. This would include hardware (computers, servers, switches, routers, HMI panels, PLC’s), software and operating systems, communication circuits and the new Internet of Things (IoT) devices. This system will let you track and reference your current equipment when new risks are announced and work towards correcting those issues.
    
2. The second step in this process are updates. It seems as an IT professional the most cumbersome thing I can present to a user are updates. Whether the updates are operating system related, application related, or even control system related, regardless of testing they always require downtime and seem to have some unexpected problems. Plus, as technology changes so fast, the possibility does exists that the vendor will no longer supports the product.  Items that used to last five or 10 years may become a working unsecure relic in a few years.
    
3. The third step in the process is policy. Starting to document how things happen in your Department is going to help you make sure routine tasks are repeatable and done in the format that can be tracked and is the most secure. When suggesting to another organization on how to implement a new policy, I always suggest one of the excellent frameworks that NIST has developed. Take one of these standards, choose five to ten policies, and modify them to fit your organizational needs.  Start with something small and simple and then you can grow the complexity.  
    
4. Step four of my process is audit. Polices are a useless if you do not routinely review what they say and make sure people are held accountable in following them. I can remember during a major flooding event many years ago, the County Attorney asked where some specific documents were for an emergency management procedures. Once the documents were located, the attorney took the book out of storage and blew about five years of accumulated dust into the crowded room. Polices will only work, when they are current and audited to make sure they are being performed.
    
5. The final and fifth step is awareness. Learning how to improve your staff’s awareness of Cyber security is important. All levels in the organization need to understand what roles each of them play. Training, attending conferences, and phishing campaigns that test your organization’s cyber savvy are all great ways to help end users understand the risks associated.  

As an IT professional, many of us need to make plans to update our skillsets and make sure our staff have the necessary skills training to stay relevant. Personally, being of the “Click-it or Ticket” generation, I think an organization needs to develop a catching campaign about cyber security and reinforce themes over and over. The first thing I do when I get in my car is buckle up. We need to create the same behavior in our associates, such as “think before you click.”

I understand my five steps do require effort to implement. It is human nature to resist change.  But the good news is there are resources that can help. The Department of Homeland Security is one common resource I use. The U.S. Department of Homeland Security’s National Protection and Programs Directorate (NPPD) and the Multi-State Information Sharing and Analysis Center (MS-ISAC) have multiple support levels from technical to administrative. You can also seek out the assistance of your local agency associations, or even create a local cyber support group in the area. No matter what steps you take, cyber risks will continue to evolve and risks and complexity will increase. That is why we leaders in the cyber community need to step up, take charge and always be aware of the ever-developing changes.