Hi, I'm Tom Field senior vice president of editorial with information security media group I'm talking today about nation state threats to critical infrastructure It's my pleasure to be speaking with Bernie Collins. He's the chief security officer with utility technology solutions Bernie Thank you so much for taking time to speak with me tonight. My pleasure Tom For our audience just take a moment please to share a bit of your background both in cyber security and in utilities Certainly so anyone who knows me knows that I I'd like to say that I've been in security since you know before it was cool So I've been a practitioner my entire career I started out in the Department of Defense as a special agent focused on counter intelligence counter terrorism and counter espionage And back then it was my job to understand our adversaries to learn to be able to spot and track or trade craft and exploit that knowledge to protect US Defense information secrets and technology and when information technology was introduced into the Department of Defense I became my job as well So there was an actual bridge for me into cyber security So I've been doing that for a long time and I left the Department of Defense I went into the commercial world and I started out running a boutique cyber security consulting firm That was focused across a variety of industries including government healthcare pharmaceuticals financial services So I got to got exposure to a lot of different industries and their issues early on in my career And then later, I was recruited by Pacific gas electric company to join their team and help build out an industry Leading cyber security practice and general security practice at the company So I've had about five years of practitioner experience in a major utility doing cyber security as well as physical security And a little bit prior to that when I was working in consulting I did have some exposure to skater systems and helping American gas association develop the initial At least some some preliminary state of protection and encryption technologies. So I've been doing this for a long time Love it.
It's a great industry And I've always been pleased to help protect not only, you know, our our nation's infrastructure But but our business and commercial interests as well Well, that's terrific context for a conversation here because as you know, whenever the nation's state threat comes up in conversation First topic is always the power grid the enemy's going to take out the power grid talk to me about some of the realities as well as the myths About power grid cyber security. Yeah, let's start with the myths I think it's important to understand that this guy is not necessarily falling with regard to the to the power grid There is a lot of work being done And if you look at some of the reporting and the news bites and and things that you see in the media It's easy to get the impression that the people who operate the grid and who are responsible for it are asleep at the wheel somehow And there could be nothing further from the truth I think several of them this indicates a lack of attention lack of awareness unpreparedness And that's simply not true the major participants in the power grid including the the major utilities and other other players Spend a great deal of time learning about the threat I mentioned it was my job way back in the day to understand what the adversary is capable of and they spent a tremendous amount of time Studying that practicing responses to to attacks developing security protocols and procedures and one of the interesting characteristics about the energy Industry is that it features a necessary and voluntary mutual cooperation and coordination effort across the board They share information like no other industry I've ever seen if something happens to one entity They're immediately on the phone with each other and through a variety of Industry and government organizations sharing that information helping each other to understand what it is what the impact is how you might want to respond and Contiring for that and I mentioned that they spent a great deal of time practicing at this past November was one of the grid exercises And they have these every two years and it features hundreds of entities who come together along with government partners to practice responding to a cyber and physical attack on the grid How would you respond? What are the different scenarios that we can expect and what are the protocols for minimizing the impact of that and getting back to Too good, so I think the perspective that nobody's paying attention is one that we really need to correct because they really are paying attention They take it very seriously. There's an incredible amount of awareness a lot of work and a lot of dedicated people who are focusing on that problem every day So at a time when we've got heightened awareness to potential threats to the power grid What would you say is the state of cyber security the nation's power grid today?
You know, no one's perfect Tom I would say that first and foremost But I think I think there's been a lot of good hard work done to help prepare for that to anticipate those sorts of things And we're not alone It's not it's not a utility standing out there by itself I mentioned there's a lot of cooperation mutual aid that goes on necessarily between the utilities You know think about the grid the interconnection of the various utilities were participating in that, you know, you have to have a lot of coordination And they do that They're very good at responding to emergencies, you know fires physical emergency outages storms and they're becoming equally adept at responding to cyber Emergencies and there's a cyber mutual assistance program among the various utilities that somebody's helped with something they can do that So I think they're well positioned to respond nobody's perfect You know, I wouldn't say that you know, they've got it nailed You know nation states present a clear danger to any industry not just the critical infrastructure industries in the United States But I think the power industry has spent a lot of time thinking about this problem If you think about critical infrastructure in the United States, you know, if there's no power It pretty much jeopardizes the other critical infrastructure industries, you know, you can run generators for a certain amount of time But putting fuel into a truck Pumping it in by hand and then distributing it to pretty you know runs out of a big realistic realistic solution If you will, you know, in a pretty short amount of time So so having you know the energy industry and up and running and protected is something that you know, we spent a great deal of time thinking about Bernie has become a cliche. We've heard an awful lot about information technology, operational technology, scale of vulnerabilities It's always come up when we talk about the critical infrastructure in the power grid. How have these been addressed in this industry? You know, that's an interesting phenomenon I you know, if you go back a little bit and look at the way state and industrial control systems evolve You know, they were never really intended to be plug into an internet that was accessible by a foreign country You know thousands of miles away, but the reality is that you're able to gain efficiencies We've done that if you're a skater system vendor or an ICS component vendor, you know updating your product and supporting your product is obviously cheap Or if you can remotely access that over the internet versus rolling a truck out to, you know, companies factory or substation or something like that So, you know, limiting what can go into those operational systems is the first step And I think a lot of companies have identified that if you look at the leading approaches to cyber security, you know, in the past I feel we as a as a practice a cyber practice tended to peanut butter cyber controls across an organization Today we do that less so we focus on what are the ground jewels and that is one of the absolute things that you have to protect if you're If you're a utility, for example, you know, losing control of your operational technology is obviously something that is a really significant problem So protecting that limiting who can access that how it can be accessed from where it can be accessed Those are the type of techniques that are being employed today to limit that exposure additionally those vendors are starting to build in protocols and Security capabilities into their products that didn't exist in the past I think there's a lot of work being done in first of all limiting who can access those control systems and secondly building in the cyber Protection and security protections that didn't exist in the past so building on that from your front row seat Where do you believe that the US has made its greatest rise in improving power grid security?
You know, I think first and foremost to be frank It's it's the awareness and now sharing if you look at other industries, you know, they cooperate and they share But there are a lot of you know legal and competitive obstacles to doing that the the electric industry, you know Companies tend to be natural monopoly. So they're a little more open to or able to to share I mean, there's still some restrictions, but they share a lot of information I think that shared awareness and that mutual assistance and the ability to look at what's happening across the industry has really been one of the most Significant steps forward for for security that and bringing in people who are focused on that most of the larger utilities today have Significant investments in cyber teams who are dedicated to doing that in the past we might have people who had you know, that was a side Job is you know running the cyber systems today virtually all of them have a dedicated team that looks at that looks at what's coming the other I think big advantage, you know, it goes into the information sharing awareness is that there's a tremendous amount of support from both the commercial sector as well as the Federal state and local governments in supporting critical infrastructure today if something happens in one area There's a lot of support from you know, if there's a criminal action law enforcement if there's some sort of nation state from the federal government I mean, there's a significant amount of assistance that's available I think that's another one of the biggest strides forward a lot of our regulatory agencies have the ability to you know Do it just by by nature the work that they do understand what works well what doesn't and share that information, you know, across the industry I don't want to ask you to draw a roadmap obviously, but what gaps do you still see I think that's there are a couple of areas where You know, I think if you ask anybody they would agree so first and foremost and I you know We started talking about at the beginning there's certainly differences between information technology and operational technology, you know It's improving. I won't say it's a huge gap right now, but in the past it was really sort of a wall the cyber guys focused on information technology That's what they were good at that's what they knew but today that operational technology that used to be the domain of the operators You know, certainly a utility those roles and responsibilities are evolving and I think I think they're on the right path There's a little good work to do there, but that that shared responsibility for protecting operational technology with the same level of expertise I think we see in some of the information technology is vital the next area that I see where there are potential gaps And this doesn't exist only in critical infrastructure for the utility industry, but certainly in supply chain security You know understanding and proving the provenance if you will the components that go into your industrial control systems is a vital importance There's a lot of focus on that today. There's a lot of working done But if you look across some of the other reporting You know, there's some I've seen some news reports about restrictions on using components from companies like Huawei I guess, you know, I understand from from pure fear that there might be the ability of the the manufacturer to be able to look into that technology and somehow Manipulate understand see what's going on across that those sorts of considerations certainly exist in the ICS world today The next area that I would I would say is a little bit gap is inside a threat You know if you think about a nation state we typically think about somebody coming in externally over the internet launching a cyber attack But if you can't get in that way, there's certainly the opportunity to do that from the inside So, you know, you can you can envision scenarios where people are either either inadvertently or winningly I should say or unwittingly co-op it into being participants people who click on a fish email, for example, are generally Unwitting participants in a potential cyber attack on the inside in other cases I've heard of people being hired into a company for the express purpose of either finding out an intellectual property or perhaps Doing something internally said I think it's a little bit of a gap And I think a lot of the critical infrastructure teams are focused on that are starting focus on that today And I think the final gap And this is not just for the utility industry is we all know that there's a shortage of people to do this work is vital work Cyber skills need to be expanded.
They need to be we need more people doing this sort of work We need to be focused on it. So I think that's a gap that we have nationally and doesn't matter what industry you're in Or whether in private sector or government sector, but I think the people is something we really need to focus on Bernie we're sitting here obviously at a time when there are heightened nation-state tensions between the US and Iran What specific concerns do you have that Iran or any adversary could actually compromise the power grid? You know, you know, the nation-state actors have demonstrated both the willingness and the ability to carry out cyber activities against You know, the United States against our critical infrastructure You know, my my concerns are really that we tend to focus our Efforts internally that is it seems that we wait for something to happen Somebody to get you know, it's hacked share that information or somebody gets breached or something happens on the inside of the network So we're really conducting that effort that protection and that that battle if you will internal to our networks Whereas I think where our focus needs to shift and I think there's some interesting technologies coming out and players coming into the cyber security space That that take that effort if you will that defensive effort in a proactive stance outside of the network out into the internet You know looking at I mentioned adversary trade craft looking at how all things are being conducted what activities happening on the internet And disrupting that action before it becomes a problem on somebody's network inside. So those those are my concerns.
I I know that nation-states are out there probing constantly just as criminals are out there probing constantly You know being able to focus outside of your own network stopping the stuff from getting in before it happens Let's you focus on the needle in the haystack that may be inside Bernie last question. What can you tell me about utility technology solutions and your new role there is chief security officer It's a really exciting role where we are looking at both technology that Supports the grid in the future modernizing the grid as well as innovative cyber That's my role looking at innovative cyber solutions out there that could benefit the grid and help help protect it and help protect our critical infrastructure So I enjoy a lot of time out meeting with companies talking to people talking to utilities looking at what their concerns and issues are Sharing the knowledge that I've gained and then helping that introduce new technologies that might be might be of advantage Well Bernie, I appreciate your time and insight today and I look forward to continuing the conversation down the Road thank you very much. My pleasure Tom. Thank you again The topic has been nation-state threats to critical infrastructure I'm speaking with Bernie Collins his chief security officer with utility technology solutions for information security media group.
I'm Tom Field. Thank you very much