McCrary Institute, utility company leaders converge to share best practices and cyber threat mitigation strategies

Auburn University’s McCrary Institute for Cyber and Critical Infrastructure Security hosted members from leading utility companies and a national laboratory on July 19-20 to discuss and share industrial control system (ICS) security best practices and cyber threat mitigation lessons. Representatives from Southern Company, American Electric Power, Dominion Resources, Duke Energy, Tennessee Valley Authority, Oak Ridge National Laboratory and McCrary Institute addressed the following priority issues:

• The electric sector threat landscape;
• The national cybersecurity strategy;
• Building a cyber-trained operational technology (OT) workforce;
• Cyber-informed engineering (CIE); and more.

“We are focused on bringing together industry, academia (Auburn), and government (Oak Ridge National Lab) for continued collaboration,” said James Goosby, Southern Company executive-in-residence and Senior Fellow at the McCrary Institute.

“These are some of the key players within their respective utilities — who are what I call ‘boots on the ground’ stakeholders — who spend every day maintaining OT systems for safety and grid reliability, while taking cyber risks into account. There is much to be learned about how we can help each other better mitigate these risks.”

Michael Cutchins, power generation engineering supervisor at Dominion Energy, reinforced the point, saying it was “important to be provided a clearer picture of what the McCrary Institute and associated partners are focused on, and to gain a better understanding of how we can contribute in order to bring value back to our industry stakeholders.”

“Meeting together as a group allows us to share knowledge and help shape the efforts of educators such as Auburn University to prepare students for the career fields of the future,” he said. “Operational technology is one of those fields.”

Tricia Schulz, Oak Ridge National Laboratory group leader for embedded systems security, underscored that “the grid is changing as we're adding distributed energy resources. We are integrating more smart technologies and have new grid asset owners.” The result, she noted, is “more surface area, more potential vulnerabilities, and more opportunities for cyberattacks that we need to be vigilant about mitigating.”

The group also discussed the need for future collaborative opportunities that support each entity’s business requirements, in addition to expanding avenues for robust development of a cyber-trained OT workforce.

“We’ll continue to work together with meetings like this to build out value-adding pathways and approaches to support moving forward,” Goosby said.