Executive Brief: Power Utilities

How Vulnerable are U.S. Utilities?

Securing the electric power grid is a top priority for critical infrastructure protection in the United States. Historically, power grid facilities had varying access control and surveillance measures focused on public safety and preventing vandalism/theft. More recently, federal agencies, Congress, and the utility industry have heightened attention on the power grid's vulnerability, particularly the high-voltage transmission system, to terrorist attacks that could cause widespread blackouts.

Until 2013, the focus was on power grid cybersecurity. However, a 2013 rifle attack on an electric transmission substation in Metcalf, CA, shifted attention to the physical security of critical assets. Since 2014, security risks to the power grid have become a greater concern.

The Federal Government Steps in to Ensure Physical Security

Unauthorized access and tampering at utility facilities, regardless of the threat source (terrorists, disgruntled employees, pranks), result in disruptions to electrical power supply and utility generation/transmission.

The Federal Energy Regulatory Commission (FERC), in response to the Metcalf attack and other incidents, ordered mandatory physical security standards for substations in 2014. Congress passed legislation to strengthen power grid physical security and facilitate recovery from attacks. A July 2014 report from the Congressional Research Service highlighted these concerns.

FERC directed the North American Electric Reliability Corporation (NERC) to submit proposed reliability standards requiring utilities with critical assets to address physical security risks and vulnerabilities.

Achieving and Maintaining Physical Security Regulatory Compliance

Today, NERC's Critical Infrastructure Protection (CIP) Standards mandate that all electric utilities implement a physical security plan and program to monitor and manage physical access, protecting critical infrastructure, cyber assets, and Bulk Electric System (BES) cyber systems.

To comply, utilities must define operational or procedural controls to restrict physical access. For authorized individuals needing access to critical infrastructure or security perimeters, utilities should:

• Implement at least one physical access control system; two or more are recommended.
• Monitor unauthorized access at all physical access points.
• Maintain records (automated or manual) of entry, including time and date, for each individual with authorized, unescorted, or unauthorized access.
• Issue an alarm or alert for unauthorized access.
• Keep physical access logs capturing the date and time of individual access.

Standard CIP-006 focuses on managing physical access to BES Cyber Systems to protect them from compromise that could lead to mis-operation or instability. Standard CIP-014 identifies and protects Transmission stations and substations, and their primary control centers, whose damage from a physical attack could cause widespread instability or cascading failures.

Role of Locking Systems in Critical Infrastructure

Utilities must support resiliency strategies to assess, prevent, detect, and recover from events. This includes perimeter hardening, cybersecurity, communications, equipment redundancy, hardening System Operations Centers, protecting critical substation assets, and recovery planning.

Secure locks are indispensable tools for addressing complex security scenarios. Internally, locks on doors, elevators, machines, shutters, cupboards, cabinets, and switchgears prevent unauthorized access. In critical infrastructure, locks must resist extreme temperatures, dust, toxic substances, fire, and explosions.

For outdoor sites, locks must perform in challenging environments like ice, snow, rain, and manipulation, securing gates, fences, doors, switchgears, and key safes.

Critical infrastructure facilities often operate across large geographic areas with multiple remote locations and require access for many people, including third-party companies and contractors needing temporary access. Locking systems must accommodate these needs.

High-security locking systems that combine electronic and mechanical security, offering an intelligent combination, are particularly beneficial. Programmable keys are powered by batteries, energizing the lock cylinder upon insertion. Communication between the cylinder and key is encrypted for high security. Programmable cylinders require no wiring, allowing fast installation and minimal on-site maintenance.

When a key is inserted, an audio indication and LED indicators inform the user of their access rights.

Key management software and programming devices enable remote and instant programming, amendment, or deletion of keys by administrators. Keys can be assigned short authorization time windows to minimize risks from lost keys. Security managers can generate timestamped audit trails for any lock or key, tracing access workflows.

In Summary, Utilities are Looking for:

• Flexible access and key management for permanent staff, part-time staff, and third-party contractors.
• Interior and exterior locking and access points supporting doors, elevators, machines, windows, shutters, cupboards, cabinets, gates, fences, and switchgears.
• Global access to management software with minimal IT investment and support.
• Multiple administration possibilities with several roles (e.g., receptionist, security manager) and minimal administration time.
• Easy support for NERC CIP audits for physical security.
• Easy key and access management for different users and their requirements.
• Health and safety compliance, working with existing processes.
• Integration possibilities with HR systems, access control systems, and task management software.

Medeco Intelligent Key Systems are a Smart Business Decision

In response to CIP Standards 006 compliance, utilities have deployed various solutions like physical access control systems, electronic access control systems, cameras, security locks, and fences. CIP-014 allows utilities to determine appropriate security measures.

Medeco offers solutions like the Medeco XT electronic locking system or the Medeco CLIQ electro-mechanical locking system, providing controlled access, accountability, physical security, and system management. These systems offer benefits similar to electronic access control systems but retrofit existing hardware without hardwiring, reducing installation time and costs.

Medeco Intelligent Key Systems deliver outstanding physical security, a hallmark of Medeco locks, built to high standards with strong protection against forced entry and tamperproof features in an attack-resistant design.

While some utilities opt for elaborate Electronic Access Control (EAC) systems, the high cost of installation, including hardwiring, cabling, construction, and potential delays, is a major drawback. Medeco Intelligent Key Systems are powered by electronic keys, requiring no hardwiring, ensuring continued operation during power failures. Medeco XT Intelligent Keys use rechargeable batteries (1,800 openings per charge), and Medeco CLIQ Intelligent Keys use replaceable coin cell batteries (20,000 cycle life). Their lack of external power sources allows deployment in all interior and exterior climates.

Installation of a Medeco Intelligent Key system is straightforward: remove the old cylinder and install the new one, enabling fast and efficient deployment for CIP Standards compliance.

Trusted Security for Critical Infrastructure

Medeco Intelligent Key Systems offer owners and operators:

• Key Management and Access Control: Respond quickly to security threats, lost/stolen keys, or personnel changes using expiring key validation intervals and remote programming. One key can access doors, cabinets, gates, and outdoor areas. Improved security through flexible access, electronic scheduling, and key management ensures the right person is at the right location at the right time. Administrators have the freedom to manage the system anytime, anywhere.
• Access Control for Mobile Workforce: Bluetooth connectivity with iOS or Android mobile phones allows users to update keys (access rights) wirelessly, anywhere, anytime.
• Audit Accountability: Information recorded in both the lock and key provides a time-and-date stamped record of every event, including authorized accesses and unauthorized attempts. The CLIQ Intelligent Key System offers customized software integration possibilities with third-party solutions or customers' IT systems via an XML/SOAP Web Services interface.
• Physical Security: Medeco XT and Medeco CLIQ Intelligent Key System products enhance security without compromising physical protection. Attack-resistant design and tamper-proof features offer strong defense against forced entry.
• Reduce Costs: Cost-effective solutions eliminate the need for users to return to administrators to update keys or replace batteries. Reduced operational costs stem from using existing hardware, easy wire-free installation, and keys providing power to the cylinder, negating the need for hard wiring or power supply. Access control for mobile workforces is enabled via Bluetooth connectivity. Reduced IT infrastructure costs are achieved through Medeco's hosted Software as a Service (SaaS) solution using Amazon Web Services (AWS) or AWS GovCloud, which provides a secure cloud environment for government customers. Medeco's ISO/IEC 27001:2013 certification affirms its commitment to information security management.
• Service Availability: Medeco offers 24/7 high-availability environments (SLA 99.9%, excluding planned maintenance), with all services monitored 24/7. Optional professional support is available 24/7.

The CIP Compliance Solution that is Easy and Cost-Effective

In a world of disruptive events, utility security is paramount. Federal actions require all North American power utilities to comply with strict regulations enforcing physical security measures.

Replacing a vulnerable mechanical key system with a Medeco Intelligent Key System is one of the most cost-effective and efficient ways for utilities to meet and sustain compliance with key NERC CIP Standards. It offers all the benefits of an electronic access control system without the high cost of expensive hardwiring.

Medeco Intelligent Key Systems significantly reduce the cost and complexity of CIP physical security compliance for power utilities. Numerous small, medium, and large utility customers across the USA and Canada utilize Medeco Intelligent Key solutions (CLIQ and XT) for physical security protection and compliance.