Human and Technical Security

Requirements for a Resilience Architecture

As before, a resilient network will ensure connectivity and quality of service for critical services in decreasing priority order, starting with SIL3, then SIL2, then SIL1, then corporate communications. It will also use virtualisationto protect each layer against lower layers.

Organization Requirements

A power station is, like an airport, a major capital asset with a lifespan measured in decades. Even if an individual nuclear reactor is decommissioned after 40 years, it's common for new reactors to be built next to old ones, as the local communities accept them and value the jobs. Power station operators are regulated; the regulation is even fiercer for transmission and distribution operators who maintain the power grid. A big issue in the USA (and also in much of Europe) is that security expenditures are not part of the regulated cost base, and thus they come directly off the company's bottom line. As the operators are typically funded by debt as well as equity this creates major resistance to any security investment that cannot save money directly.

In the USA, attempts to make power station operators invest in information security backfired in 2009. FERC/NERC regulations stipulated that all critical assets had by then to meet minimum information security standards; in the case of generating plant, a 'critical' unit was one with black start capability - the means of coming online in the absence of grid power. Hydro plant does have black start capability; nuclear does not; and coal-fired stations generally only do if they have auxiliary diesel generators. Operators' response to the FERC/NERC regulations was to scrap diesel generators rather than installing firewalls, thus making the US power grids less resilient.

So, just as in the airport case, an attractive feature of SDN is that it has the potential to save money as well as providing more robust network virtualisation. Its deployability in lean commercial environments is one of its strong points.