Bringing a zero-trust architecture to energy

This blog in our energy digitalization series questions the resiliency of today’s energy infrastructure. In particular, we ask if an architecture built around perimeter defenses is adequate for the complexity of modern, interconnected systems and data—presenting a broad and disparate attack surface. 

Contemporary information security for critical energy infrastructure is… an eggshell? 

Cybersecurity for energy sites was built around the same architecture for physical security. Perimeter defenses – fences, badges, neutral zones – have been replicated with firewalls, virtual private networks (VPNs) and demilitarized zones (DMZs). Sometimes, these come with Transport Layer Security (TLS) sprinkled on top. This so-called “castle and mote” architecture trusts data so long as it comes from inside of these isolated environments. 

Like an eggshell, however, VPN and TLS-reliant network security is:

• Brittle – Misconfigurations and complex networks frequently leak and expose unencrypted data.
• Hollow – Once inside, intruders can move laterally to gain control of resources within the network
• Porous – Even air-gapped systems have entry points and are at risk.
• Homogenous – Interdependent systems are vulnerable to replay attacks when hackers replicate valid data to spoof communications.

The result of these fragile defenses was put on terrifying display in the early days of the Ukraine-Russia conflict. On February 22, 2022, Germany’s Enercon reported the disruption of 5,800 turbines from a cyberattack traced to a misconfigured VPN. It would take 2 months to get 95% of the turbines back online and operational. I don’t need to be an energy executive to figure out how devastating an attack like that would be for already razor-thin margins in the wind industry. 

These security approaches have their time and place. VPN was originally designed in 1995 to protect business data over insecure networks through a secure ‘tunnel’ on the network layer. TLS was similarly introduced in 1996 to handle credit card information between customers and web store servers. However, their applications are designed for information technology (IT) rather than operational technology (OT). As energy companies pursue the convergence of IT/OT systems, the attack surface from cyberthreats grows exponentially.

Securing energy’s infrastructure with a new trust approach 

The digitalization and digital transformation of energy is bringing many benefits, with interconnected, data-driven systems that enhance efficiency, sustainability, and responsiveness. But these systems cannot remain secure with traditional approaches that protect the wires, not the data. Today, the next evolution of network security is built on the principles of a zero-trust architecture (ZTA). Under ZTA-based security, all traffic and data is untrusted by default. All users and devices must be authenticated before it can be accepted. ZTA proposes a system much like  high-grade access control at a critical infrastructure site where a badge must be displayed at all times and any administrative task requires a trail of paperwork.

We set out to deliver a solution that extends zero trust principles for energy sites with Intertrust Virtual Operations Center (VOX). VOX is built on authentication and authorization at its very core. Access and distribution of datasets is strictly defined through fine grain governance controls. Immutable audit logs track changes and actions. Data is persistently protected at-rest and in-transit with Intertrust’s unique Explicit Private Networking (XPN) technology.

The real icing on the cake is VOX’s use of XPN for data security. XPN validates the authenticity of data during ingestion and issues secure commands for true end-to-end security from the edge to cloud and back. Here are a handful of the benefits from adopting XPN:

1. Reduced cybersecurity risk. XPN works in-line with existing protections (TLS, VPN, etc) and provides additional defense against man-in-the-middle attacks, false data injections, and device spoofing.
2. Authorized control of remote assets. Energy companies can issue authorized commands to steer wind turbines, curtail solar inverters, or turn off appliances in virtual power plants.
3. Compliance with regulatory standards. XPN provides critical data security functions that organizations require for compliance with NIST CSF, NERC CIP, and the upcoming EU Cyber Resilience Act.

XPN provides a more flexible and interoperable communications protocol by abstracting up the Open Systems Interconnection (OSI) Model at the application layer. Unlike TLS, XPN can tunnel through insecure protocols like Modbus to enable strong encryption. By bridging across environments, XPN enables direct communications across industrial, enterprise, and consumer domains.

In summary, the cybersecurity landscape for energy sites is rapidly evolving, with traditional methods like VPNs and TLS proving insufficient against sophisticated cyber threats. The adoption of a zero-trust architecture (ZTA) represents a significant shift, prioritizing rigorous authentication and authorization for every user and device. Intertrust’s Virtual Operations Center (VOX) exemplifies this new era of cybersecurity, leveraging XPN technology to ensure end-to-end security and compliance with various regulatory standards. VOX’s approach, with its focus on persistent protection and fine-grain governance controls, offers a robust solution to the vulnerabilities exposed by contemporary network security methods.

For energy companies looking to secure their critical infrastructure against emerging cyber threats, embracing this new paradigm is crucial. If you’re interested in discussing how these advanced cybersecurity solutions can be tailored to protect your energy site, or if you wish to learn more about how VOX and XPN can enhance your operation, feel free to reach out. 

Let’s chat about safeguarding your operations in this ever-evolving digital landscape and ensure your energy infrastructure is designed with the most robust and advanced security measures available.