Addressing Security Concerns with Centralized Asset Data

Before asset owners can reap the benefits of a centralized platform, they must be confident that their data will be completely secure.

The U.S. power grid is one of the top concerns for national security. Americans saw the very real threat of attack from cyber terrorists last year when a Russian operation hacked a Vermont utility and when hackers took down a power grid in the Ukraine. Addressing security weaknesses is a top priority for the Department of Homeland Security and for every utility across the nation. Understandably, the idea of sharing data can be worrisome for joint use asset owners. The threat of cyber-attacks cannot be understated.

When weighing the risks versus benefits of data sharing, it’s important to understand the type of data being considered. In this article, we are talking about a centralized platform that houses data specific to individual infrastructure assets. So, this is data about the location and condition of assets (such as poles and conduit), not the network itself. Pole locations can be easily identified simply by driving down a street or by viewing Google Maps. But by organizing this asset data into a system that is easily searchable and has the potential to share data with internal or external parties, the result offers greater functionality and easier accessibility.

However, it is critical that data is not vulnerable to anyone who wants it. Comprehensive, advanced security measures must be in place for any data-sharing system.

Data Security for a Centralized Platform
When any technology contains data that is tied into a utility’s enterprise systems, there is concern for security, and the potential for cyber hackers to gain access.

Security best practices should be applied to all layers in a technology stack. 

At the application level, a centralized platform should feature advanced protections against various attack vectors.  Here are a few examples of security concerns that you should specifically address in your platform:

• SQL-injection attacks
• Attacks that would compromise passwords, security tokens, and session keys
• XSS attacks
• Worms, Trojans, software vulnerabilities and other intrusions
• Cross-site request forgery
• Zero-day attacks
• Ransomware
• Sensitive data exposure
• Data leakage between parties
• Blended threats that originate from multiple sources, operate at multiple layers and use multiple protocols

The security tools to enforce these protections include standard authentication and authorization protocol; data validation, encoding, and escaping; in-transit encryption; password protection and lockout capabilities; anti-virus and anti-spyware protection; GeoIP filtering; network-based anti-malware; role-based access controls; and employee background checks.

In response to the constantly changing landscape of cyber threats, it is also critical to maintain continuous reviews of new attack measures, employ daily code reviews, and perform regular penetration testing.

Controls on Data Sharing
Extensive data security measures must be in place so that asset owners can have confidence in their ability to protect asset data, while benefiting from increased efficiencies by sharing relevant data of their choice. Using a centralized platform, owners can direct the system to share data sets and defined searches within the organization and/or externally with third-parties, such as attachers, based on individual log-in criteria.