Water, Electric Generation and Climate Change

Note:  The following is a paper I've prepared for my Masters in Infrastructure Planning and Management at the University of Washington, Seattle.  I think you may find this interesting in light of today's concerns about water for thermal power plants.

###########

Background

I have been associated with electricity generation in one form or other as part of my profession since 1974.  I have operated nuclear power plants and been associated with hydroelectric generation, combustion turbine generation, coal-fired generation and even wind/solar and distributed generation such as diesel generators.  During this time I've learned that water is a very critical and foundational service for the thermal plants in particular.  Unfortunately as time progresses we are witnessing more issues relative to reduced availability and quantity of water for these plants.  Additionally there are challenges with climate change causing the water temperatures to rise and thus make it more difficult to efficiently generate power at some nuclear and coal-fired plants.

Key Aspects of Water and Electricity Generation

As noted above the key aspects of water supply and thermal energy generation is the quantity used and the maximum temperature permitted for plant operation. In the table below, you can see that water use for thermal/non-hydro generation can be substantial:

http://www.westernresourceadvocates.org/water/waterenergy.php

Not only is a substantial quantity of water required for electricity generation but you should also consider that the discharge from the plant could contribute to increasing the temperature of the regional water supply which has impacts on fisheries, algae blooms, etc.

For some added statistics, the amount of water the nation's 19,000 power generating units consume is approximately 100 billion gallons a day -- three times what cascades over Niagara Falls in the same time frame. (Spiegel 2012)

http://www.ctmirror.org/story/2012/09/19/millstone-shutdown-sign-broader-power-problem-caused-climate-change

Case Examples

Some case examples where water quantity/volume and temperature have played key roles in the ability of the plants to generate or not are as follows:

Millstone Nuclear Plant, Connecticut, 2012

In August 2012 the Millstone Nuclear Power Station near New London, Connecticut, was shut down for 12 days because the seawater used to cool the plant’s Unit 2 generating plant became too warm.  It was the first time any US nuclear plant was shut down because of intake water thermal limits.  The source of the cooling water is Long Island Sound. Of note and since 1975 when the plant started up, plant scientists have noted that Long Island Sound’s temperature rise about 0.7 degrees F a decade for about 2.8 degrees total.  This increase is attributed to ocean temperature rise due to climate change. (Spiegel 2012)

Browns Ferry Nuclear Plant, Alabama, 2011

The Browns Ferry Nuclear Plant in Alabama had to shut down more than once the summer of 2011 because the Tennessee River's water was too warm to use it for cooling. (Koch 2012)

North Texas Power Plant, 2011

One North Texas power plant (name unknown) had to reduce its generation output because the water level in its cooling reservoir had fallen substantially. (Fowler 2011)

Corette Power Plant, Montana, 2001

The 160-megawatt Corette Power Plant, located along the Yellowstone River in Billings, Montana, depends on a once-through cooling system, diverting 54-million gallons of water from the Yellowstone River each day. The plant’s water intake pumps work only if the river flow stays above 1,500 cubic feet per second. In recent years, this threshold was not met for several days at a time, forcing the plant to shut down.   In this case water flow rates affect the ability of the plant to operate or not. (Clean Air Task Force 2003)

Some Conclusions

According to a study commissioned by the European Commission and entitled “Vulnerability of US and European Electricity Supply to Climate Change,” projects that the next 50 years of warmer water and lower water flows will lead to more power generation disruptions.  The authors project that thermoelectric power generating capacity from 2031 to 2060 will drop by 4 and 16 percent in the US and 6 and 19 percent in Europe due to lack of cooling water.  They also go on to note that the likelihood of extreme drops in power generation – complete or total shutdowns – is projected to almost triple. (van Vliet, et al. 2012)

This report goes on to note that reduced water availability and warmer water – caused by increasing air temperature associated with climate change – will result in higher electricity costs and reduced reliability.  Those plants that rely on once-through cooing are the most vulnerable versus those that recycle their cooing water via cooling towers.

Discharging water at elevated temperatures causes yet another problem: downstream thermal pollution which can affect life cycles of affected aquatic flora and fauna.  Also, this higher temperature could be an added impact on downstream power generation using the same water for cooling.

Overall, this appears to be a very interesting area to pursue further research and review of the current issues with water, electricity generation and climate change.

Bibliography

Clean Air Task Force. "The Last Straw: Water Use by Power Plants in the Arid West." The Last Straw: Water Use by Power Plants in the Arid West. April 2003. http://www.westernresourceadvocates.org/media/pdf/laststraw2009.pdf (accessed January 12, 2014).

Fowler, Tom. More power plant woes likely if Texas drought drags into winter. August 24, 2011. http://fuelfix.com/blog/2011/08/24/more-power-plant-woes-likely-if-texas-drought-drags-into-winter/ (accessed January 12, 2014).

Hickey, Hanna. Nuclear and coal-fired electrical plants vulnerable to climate change. June 3, 2012. http://www.eurekalert.org/pub_releases/2012-06/uow-nac053112.php (accessed January 12, 2014).

Koch, Wendy. Climate change causes nuclear, coal plant shutdowns. June 5, 2012. http://content.usatoday.com/communities/greenhouse/post/2012/06/climate-change-makes-nuclear-coal-power-plants-vulnerable/1#.UtLevfRDua8 (accessed January 12, 2014).

Spiegel, Jan Ellen. Millstone shutdown is a sign of broader power problem caused by climate change. September 24, 2012. http://www.ctmirror.org/story/2012/09/19/millstone-shutdown-sign-broader-power-problem-caused-climate-change (accessed January 12, 2014).

van Vliet, Michelle T. H., John R. Yearsley, Fulco Ludwig, Stefan Vögele, Dennis P. Lettenmaier, and Pavel Kabat. "Vulnerability of US and European electricity supply to climate change." Nature Climate Change (Macmillan Publishers Limited), June 2012: 1-6.

Western Resource Advocates. Water Use for Energy. n.d. http://www.westernresourceadvocates.org/water/waterenergy.php (accessed January 12, 2014).

SANS White Paper -- Cybersecurity Response to Physical Breaches of Unmanned Critical Infrastructure Sites

Our friend Mike Assante -- formerly of Idaho National Labs/National SCADA Test Bed, NERC, and now with SANS -- has coauthored an interesting and informative white paper on responses to physical breaches of unmanned critical infrastructure sites. The cover is shown below.

The whitepaper can be located at: http://tinyurl.com/ldfnzxq

One of the most interesting graphics in the paper (Appendix A, Page 12) is a collection of photos showing the ways/means of the miscreants to tap into the systems with such tools as keystroke loggers, etc.  The page is shown below to whet your appetite for this paper.

Nicely done and "attaboys" to Mike Assante, Scott D. Swartz and the SANS ICS team!

Also, my good friend Andy Bochman wrote about this at his Smart Grid Security Blog.  Thanks, Andy!!

####################

National Infrastructure Protection Plan (NIPP) - Released Dec 2013

On December 20, 2013, the newly revised National Infrastructure Protection Plan (NIPP) was issued by the US Department of Homeland Security.  NIPP 2013: Partnering for Critical Infrastructure Security and Resilience is available on the DHS Web site along with a Fact Sheet.    

President Obama's February 2013 Presidential Policy Directive 21 (PPD-21) regarding needed improvements in critical infrastructure security and resilience called for an update to the NIPP which was originally issued in 2006 and revised in 2009.  PPD-21, Critical Infrastructure Security and Resilience, explicitly calls for the development of an updated national plan. The directive builds on the work done to date to protect critical infrastructure, and describes a national policy to 1) share threat information, 2) reduce vulnerabilities, 3) minimize consequences, and 4) hasten response and recovery efforts related to critical infrastructure. It also identifies 16 critical infrastructure sectors, listed in the box below:

https://www.dhs.gov/national-infrastructure-protection-plan 

The document is 57 pages long and includes some history on the evolution of the NIPP.  There are a few useful graphics regarding the new threats to critical infrastructure (page 8) and how the NIPP 2013 elements help sustain improved security of the critical assets (page 6).

A useful table showing the different critical infrastructure sectors and the assigned Federal agency responsibilities is shown below (Table 1, Page 11).  This table gives you a good sense of the different sectors and how cross-coordination is intended to operate.

Finally the document includes a Call to Action that highlights 12 separate actions aimed at enhancing national critical infrastructure security and resilience.  A summary list of the actions are:

Build Upon Partnership Efforts
1)  Set National Focus through Jointly Developed Priorities
2)  Determine Collective Actions through Joint Planning Efforts
3)  Empower Local and Regional Partnerships to Build Capacity Nationally
4)  Leverage Incentives to Advance Security and Resilience

Innovate in Managing Risk
5)  Enable Risk-Informed Decision Making through Enhanced Situational Awareness
6)  Analyze Infrastructure Dependencies, Interdependencies, and Associated Cascading Effects
7)  Identify, Assess, and Respond to Unanticipated Infrastructure Cascading Effects During and Following Incidents
8)  Promote Infrastructure, Community, and Regional Recovery Following Incidents
9)  Strengthen Coordinated Development and Delivery of Technical Assistance, Training, and Education
10)  Improve Critical Infrastructure Security and Resilience by Advancing Research and Development Solutions

Focus on Outcomes
11)  Evaluate Progress toward the Achievement of Goals
12)  Learn and Adapt During and After Exercises and Incidents


Key Take-Aways

This document is a reference on understanding the background of the National Infrastructure Protection Plan and gives the reader a high-level sense of the policy and objectives for protecting our national critical infrastructure.  It is probably useful to know that this document exists but more specific details on how infrastructure is protected will be in sector-specific plans and plans developed by the infrastructure owners and operators.

##################################

2014 -- And What It Brings...

Happy New Year!  Welcome to 2014 and all the opportunities it brings!

Wow, 2013 has flown by!  For this year I will continue to focus this Blog on Critical Infrastructure issues and augment it with some discussions focused on some of the key questions and topics I think will affect all of us this year.

So, for a “bulletized” recap of the topical areas I’ll ponder please consider the following:

·         Critical Infrastructure Protection

o   What will happen with the NIST Cybersecurity Framework?

o   What news and events will surface for the 16 critical infrastructure areas designated by PDD-21?

o   How will the electric industry react to the new NERC CIP Version 5 mandates? And the NIST Cybersecurity Framework?

·         Industrial Controls Systems Security

o   This is a continuation of the areas reviewed last year including the SANS Global Industrial Cyber Security Professional (GICSP) certification activities and new ICS-security emphasis from other cyber-security agencies outside of the US ICS-CERT and even overseas with ENISA, etc.

·         Supply Chain Security

o   I find this a fascinating topic that is finally getting to the front pages of many business journals

o   Again, I will be examining ideas for both physical and cyber protection as well as new legislation impacting cyber defense and threat mitigation

·         Cyberwar

o   This area is particularly intriguing with continued stories about nation-state attacks and defenses

o   Added discussions about “hack-back” and “Active Defense” will be included

·         Cyber Risk Issues and Psychology of Security/Risk

o   The annual meeting in Davos for the WorldEconomic Forum surfaces some very interesting discussions about threats to the digital economy that are not part of the mainstream IT press

So, this should be an interesting year and one that keeps us all busy.  Overall, though, my objectives for this Blog are to a) educate, b) entertain and c) make you think about today’s new challenges to our security and critical infrastructure resilience.

Lastly, I’ll also be busy with Twitter forwarding news items that follow the themes above.  Feel free to follow me @ErnieHayden

I look forward to your comments, ideas and feedback and if you hear of some news items that fit into my list above, I’d love to hear about it at enhayden1321@gmail.com

Happy New Year and all the best!

Ernie

Job Opportunity - Industrial Control System Security Lead

My good friend Dave Tyson -- CISO at SC Johnson -- has asked me to pass along his current opening for someone to help with his industrial control systems (ICS) security.  The job posting is below.

If you are interested or you are aware of another qualified candidate, feel free to contact Dave with a resume at dntyson@scj.com.

### - ###

Industrial Control System Security Lead 

Global Information Security Team

Reporting to the Leader, Global Information Security Business Advisory (GISBA) the lead for the Global Product Supply (GPS) Information Security program is responsible for developing and managing the GPS Information Security program. 

This leader will own and drive the global rollout of a more robust and formal approach to managing information security risk in the GPS environment. The structure of the program will be based on the goals, principles and strategy of the overall Global Information Security Enterprise Security Strategy at SCJ. At its core, this program will ensure appropriate security management while driving breakthrough performance in governing business appropriate risk to data and systems. The GPS security lead will optimize team processes to ensure efficient and effective delivery of services in a 24x7 ‘follow the sun’ operating model.

Position Overview:

We are seeking a professional with a deep background of Industrial Control Systems Cyber Security Engineering and Architecture. The candidate is expected to be a visionary technologist and demonstrate a combination of leadership, technical and program management skills. The successful candidate will lead both current security enhancement programs as well as the development of a sustainability effort to build a globally sustainable information security program.

Responsibilities:

·         Identify new technologies, processes and programs to enhance security, reliability and customer experience.

·         Identify operational issues and define design alternatives to address these issues.

·         Act as a technical advisor and subject matter expert to internal stakeholders and partners

·         Coordinate with the Global Information Security Operations team for malware analysis, and testing of remediation processes.

·         Perform detailed and technical analysis of ICS and help integrate cyber security solutions worldwide.

·         Maintain a superior knowledge of the cyber security capabilities of operating systems, networking devices, control systems, and vendor offerings.

·         Maintain a working knowledge of applicable cyber security standards involving critical infrastructure, including those relating to process networks

·         Understand technical issues and the implications to the business, and be able to communicate them to management and other business leaders.

 Capabilities:

   ·         Ability to effectively work in a matrix management environment

·         Strong communication and presentation skills

·         The ability to lead large groups and be a primary facilitator

·         Strong written skills

·         Comfortable working in a project based / client serving model

·         Ability to lead and shape client expectations

·         Help drive pursuits and engage in complex deals, matching outcomes to expectations

·         Ability to work easily with diverse and dynamic teams

·         Ability to work in a matrix management model

·         Readiness to travel 25-50% initially

·         Experience in working international organizations roles

Qualifications:

·         7-10+ years recent experience in large enterprise environment

·         Demonstrated experience with implementing and maintaining security in large, complex Industrial Control System environments, etc.)

·         Experience with securing SCADA, PLC, and HMI systems, etc.

·         Strong networking background with minimum 3 years of networking experience; and routing, switching, network security and packet analysis

·         Experience in the capabilities and/or configuration of cyber security controls, specifically those relating to firewalls, access control, authentication, anti-virus/anti-malware, patching and hotfix, logging and SIEM.

·         Ability to train, manage and assist co-workers on all aspects of security awareness, controls and compliance

·         Superior written, presentation, and verbal communication skills

·         Exceptional organizational, interpersonal and team skills

·         Ownership orientation to solving problems

·         Information security and data protection skills are desired

·         Experience managing and leading

·         Ability to pass a detailed security background screening

·         Education – Bachelor’s degree or equivalent education and experience

·         Professional Certification – CISSP, CPP or equivalent will be considered advantageous

Neuroscience, Risk and Security

For years I have been a student and practitioner of security – both cyber and physical.  My initial years focused on the “Security 101” elements with a “castle and moat” approach for both physical assets and cyber (i.e., the “walls” were “firewalls”).  Over time, however, I’ve realized that there is more to security than wondering about the bits and bytes or the sizes of chain link fence mesh.  Instead, I’ve begun to recognize more and more that the human element – that is the attacker and defender – needs to be studied and recognized as a key element.

(Artwork from Microsoft Open Source)

I’ve realized – with some considerable influence from Bruce Schneier in his seminal essay “The Psychology of Security,” and from other thought leaders in the security space such as Kirk Bailey at the University of Washington or Robert Coles at GlaxoSmithKlein -- that you need to understand what motivates the attacker and what helps the defender recognize new ways and means of defending against the wiley aggressor.

In other words, I came to realize that neuroscience should play a key role in helping security professionals understand the attacker’s “brain” so to speak and thus their motivations.

Samad Aidane PMP

Last night I had a fascinating discussion on this very subject with my friend and colleague Mr. Samad Aidane.  Samad and I first met in 2004 or so when I was the information security manager/CISO at the Port of Seattle.  Samad was a newly hired project manager.  Since then we have both expanded our horizons and Samad has evolved his expertise in the realm of neuroscience and project management as well as risk.

Anyway, our conversation tonight revolved around Samad’s new research and focus on the neuroscience behind effective project management and risk.  In fact, Samad has even begun a blog at Neurofrontier.com to expand his and his reader’s awareness of neuroscience and leadership.  I’d like to suggest you take a look at his blog and get a sense of his perspectives on this new science.

A key take-away from my conversation with Samad was that how the brain functions when analyzing risk may be excellent knowledge for security and risk professionals to leverage when dealing with risk analysis decisions.  Similarly, understanding how the brain functions when establishing attack and defense concepts may be very useful to the cyber and physical security defender.  And, of course, if you lean on the concept of “Assumption of Breach”[1] for your enterprise cyber and physical defense, perhaps knowing how the brain functions and reacts could be very useful.

I am excited about the new ideas raised by Samad last evening and I look forward to our next meeting and discussions.  In the meantime, take a moment to look at Samad’s website and review some of his ideas.  You may see a sliver of some new concepts for the security profession to lean on as we try to stop the bad guys!

---

[1] For my past articles on this subject please go to my article in Asian Power at http://asian-power.com/node/11144 or my article in SearchSecurity at http://searchsecurity.techtarget.com/tip/Assumption-of-breach-How-a-new-mindset-can-help-protect-critical-data

NIST CYBERSECURITY FRAMEWORK - COMMENTS DUE FRIDAY 12/13!

A few weeks ago I prepared a blog for Tofino Security summarizing the key aspects of the DRAFT NIST Cybersecurity Framework.  I guess I hit the target because the blog has been posted on a few other sites and referred to in some Tweets.

(From Cover of National Infrastructure Protection Plan - http://www.dhs.gov/xlibrary/assets/NIPP_Plan.pdf)

Anyway, as one of my readers, my original submittal for the Tofino blog is posted below.

But, don't forget, NIST has requested comments on the Cybersecurity Framework by Friday, December 13th.

Take care, have a great and safe week, and here is the blog.................Ernie

########################################

You may have heard a bit of buzz in the US national and even international press about the release of the Cybersecurity Framework Draft from the US National Institute of Standards and Technology (NIST).  However, you may not know about its background or what it may mean to you as a control systems manager.  As such, this is intended to give you a high level overview of the genesis of this document and give you some points of reference.

Background

As we realize more and more everyday our national infrastructure – in Canada, the US or any country for that matter – is very important to our economies as well as our own national defense.  Because of concerns over continued cyber attacks on US national infrastructure – such as the electric grid, water systems, transportation networks, banks/financial institutions, critical manufacturing, etc. – President Obama issued Executive Order 13636, “Improving Critical Infrastructure Cybersecurity,” on February 12, 2013. 

This document is fondly referred to as the “EO.”

The EO also called for development of a voluntary Cybersecurity Framework to provide a “…prioritized, flexible, repeatable, performance-based, and cost-effective approach” for assisting organizations responsible for critical infrastructure services to thus manage cybersecurity risk.

Critical infrastructure is defined in the EO as “…systems and assets – whether physical or virtual – so vital to the US that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.”  Example industry sectors – and the corresponding Federal oversight agency -- considered as “critical infrastructure” include[1]: 

As a follow up to the EO and PPD, NIST was assigned responsibility for development of the Framework in collaboration with industry feedback.  The Framework is intended to provide guidance to an organization on managing cybersecurity risk.  A key objective of the Framework is to encourage organizations to consider cyber security risk as a priority similar to financial, safety and operational risk while factoring in larger systemic risks inherent to critical infrastructure.

In other words, cybersecurity risk and considerations need to be included in the day-to-day discussions at your company or organization as you expand your business, build new facilities, install new equipment and hire new people.

Let’s Talk About the Framework

First, the EO instructed NIST to be the lead in developing the Framework.  As such you can find the Framework DRAFT document and supporting information at www.nist.gov.

And, what does the Framework contain?  The Cybersecurity Framework shall:

• include a set of standards, methodologies, procedures, and processes that align policy, business, and technological approaches to address cyber risks.
• shall incorporate voluntary consensus standards and industry best practices to the fullest extent possible.
• shall be consistent with voluntary international standards when such international standards will advance the objectives of this order.

And, what is the Framework supposed to do?  The Framework:

• shall provide a prioritized, flexible, repeatable, performance-based, and cost-effective approach, including information security measures and controls, to help owners and operators of critical infrastructure identify, assess, and manage cyber risk.
  
• shall focus on identifying cross-sector security standards and guidelines applicable to critical infrastructure.
  
• will also identify areas for improvement that should be addressed through future collaboration with particular sectors and standards-developing organizations.
  
• should provide guidance that is technology neutral and enables critical infrastructure sectors to benefit from a competitive market for products and services that meet the standards, methodologies, procedures and processed developed to address cyber risks.  And,
  
• shall include guidance for measuring the performance of an entity in implementing the Cybersecurity Framework.

So, with the guidance above – and with input from industry – the draft of the Framework is intended to provide a common language and mechanism for organizations to:

• Describe their current cybersecurity posture (and a semblance of maturity level)
  
•  Describe their target state for cybersecurity
  
•  Identify and prioritize opportunities for cybersecurity improvement within the context of risk management
  
• Assess progress toward the target state, and
  
•  Foster communications among internal and external stakeholders.

A key aspect of the Framework is that it is not intended to replace an organization’s existing business or cybersecurity risk management process and cybersecurity program.  Instead, the organization can use its current processes and leverage the Framework to identify areas to improve its cybersecurity risk management.  Also, the Framework can be helpful to a company that does not have a currently existing cybersecurity program so they can build in key elements raised by the Framework.

So, What Should You Do with the Framework?

First of all, take a look at the list of the critical infrastructures listed above.  Does your company fall into any of those categories?  If not, is your company substantially reliant on any of those key infrastructures for your success and even existence?  If the answer to either is YES then I’d suggest you take time to read the Framework as it stands and figure out how you can apply it to your current cybersecurity risk management.

Secondly, acquaint your Executive Management and Board Members with the Framework.  Give them a sense of how your company stands today relative to the Framework Implementation Tiers listed.  Use this as a means of highlighting your organization’s “…cybersecurity maturity level…” and if you aren’t at the top, use it to highlight the resources (i.e., people, time and money) you need to raise your game.

Thirdly, take a hard look at the Framework and even “test drive” it as it stands.  Be sure to provide comments back to NIST as described at their page “Request for Comments on the Preliminary Cybersecurity Framework.”  Comments are requested before December 13, 2013.

Final Thoughts

When you read the draft Framework, recognize that it is not a “checklist” or a simple “compliance” item to be fulfilled.  Instead it provides a set of performance objectives for your cybersecurity risk program to achieve for your prioritized list of key assets.  But also, it is not a “how-to” on building a security program.

So, even for our Canadian friends, be sure to take time to look the Framework over. 

---

[1] From the corresponding President Policy Directive (PPD) 21 “Critical Infrastructure Security and Resilience” that was issued at the same time as the EO. Link: http://www.whitehouse.gov/the-press-office/2013/02/12/presidential-policy-directive-critical-infrastructure-security-and-resil