Access Control and Permission Management Guideline: Generation Cyber Security

Cyber security standards have been produced as a result of continual threats to business and process control networks. Many standards have been drafted, have undergone revision, and are being enforced for compliance. Cyber security strategies and technologies will reduce the vulnerability of power plant control systems to malicious attacks that could cause disruption to electricity generation and damage to equipment. Technology-assisted early detection and prevention of cyber attacks can ensure reliable, safe, environmentally sound, and economical operation of critical generating units.

A variety of cyber security solution topics for securing instrumentation and control (I&C) systems were nominated through collaboration with energy generation providers. The focus was on solutions implemented in the fossil power industry, but solutions from other industries were also considered. For each selected solution topic, the project team studied how the technology works, implementation options and best practices, field installations, and capabilities/limitations. The project participants established and prioritized solution topics to study.

  • The objective of this project is to investigate and document a series of solution topics for control system security within the fossil generation sector.
  • The goal is to enable effective application and foster new technology developments.
  • Access management helps in reducing the attack surface of power plant control systems that protect against malicious attacks that could cause disruption to electricity generation and damage to equipment.
  • Access control and permission have been covered in the report, which provides the user with guidelines and information to deal with security issues and bolstering the management of such issues. Refer to Section 3 for details.
  • This report discusses access control within an operational technology environment and suggests measures for achieving it. Refer to Section 6.1 and 6.2 for details.

This research provides new knowledge and practical approaches and recommended process guidance for developing an access management program for digital assets within plant industrial control systems. This also provides important information and solution recommendations that will assist participants in meeting Critical Infrastructure Protection requirements where applicable. Participants will also gain knowledge and observe practical implementation guidance for a variety of options for establishing required control system security. This can improve their abilities to address elements of cyber security standards through improved understanding of strategies and technology options.

Download Report