Critical Utility Infrastructure

Size: px

Start display at page:

Download "Critical Utility Infrastructure"

Shannon Simpson
5 years ago
Views:

1 GSX Global Security Exchange Critical Utility Infrastructure Prepare, Respond, Restore and Recover (Shown as Overcoming Threats to a Utility's Critical Infrastructure) Anthony Hurley, CPP, PCI, MEP Monday, September 24 th, 2018 Las Vegas, NV

2 Anthony Hurley Speakers Bio Thirty-seven (37) years in the electric utility industry (retired VP of Operations / Fortune 20) Joined Witt O Brien s, a crisis management firm, in January 2017 Member, and former Chair of the ASIS International Utilities Security Council (USC) Certified Protection Professional (CPP ) Professional Certified Investigator (PCI ) Former Vice-Chair, and Energy Sector Chair, New Jersey Homeland Security and Preparedness, Infrastructure Advisory Committee (IAC) Adjunct Instructor, NYU, School of Professional Studies Infrastructure Security and Resilience Adjunct Instructor, FEMA Emergency Management Institute (EMI) Master Exercise Practitioner (MEP) Member, Infragard (FBI Alliance), Austin, Texas Chapter Member, NEMA, Information Sharing Committee Member, All Hazards Consortium, Fleet Movement Group Graduate FBI Citizen s Academy (Cleveland Field Office)

3 Abstract / Objectives The critical nature of a utility's infrastructure is underscored each time it is damaged or rendered inoperable by a weather, man-made, or terrorist event. The absence of electric, communications, water, wastewater, or gas assets cripples communities, homes, and businesses. Experts from the ASIS International Utility Security Council highlight the preparedness, response, restoration, and recovery processes that must be in place when utility assets are compromised. Learn the need for strong privatepublic partnerships, which are essential components in the recovery of a utility's infrastructure.

4 What is Critical Infrastructure (CI)? There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.

5 Utility Critical Infrastructure Critical Infrastructure Security and Resilience Of these sixteen (16) critical infrastructure sectors, utilities have assets in five (5) of the sectors. These are, Energy, which is electric and natural gas; Dams, those that have hydroelectric capabilities; Nuclear reactors, materials and waste; the Water and Wastewater systems, which may operate under the same company or Public Works organization, or may operate as a separate entity; and Communications, which includes telecommunications, and related backbone infrastructure.

6 Critical Infrastructure Sectors (Utilities) Utility sectors highlighted

7 Critical Infrastructure Sectors (Utilities) Utility sectors highlighted

8 Prepare, Response, Restore and Recover Note: Applicable for weather, manmade of terrorist events.

Prepare Maintain Emergency Operating Plans (EOP) Exercise and drill to test your teams preparedness (EOP as platform) Conduct with others (agencies and other utilities) Follow the Homeland Security

9 Prepare Maintain Emergency Operating Plans (EOP) Exercise and drill to test your teams preparedness (EOP as platform) Conduct with others (agencies and other utilities) Follow the Homeland Security Exercise and Evaluation Program (HSEEP) Be active with industry associations Best practices Mutual Aid agreements Material sharing / Manufacturer coordination Embrace Public Private Partnerships Know your local FBI coordinator and Protective Security Advisor (PSA) Information Sharing is accomplished through trust and credentials Develop strong relationships with regulators Develop a working relationship with your state Fusion Center Work with all applicable federal, state, county and municipal agencies FBI, PSA, EPA, DOE, USACE, USDA, the list goes on. Be willing to deploy staff to state or county Emergency Operations Centers Communicate your EOP Maintain a prioritization list of assets to restore in order Have a robust pre-event preparedness checklist in place Be prepared to provide support and receive support

Prepare (continued) Pre-Events Checklists should consider: Place key staff on alert, and notify all staff Prepare EOC, test onsite generation, test all systems and computers Test / fuel (top off)

10 Prepare (continued) Pre-Events Checklists should consider: Place key staff on alert, and notify all staff Prepare EOC, test onsite generation, test all systems and computers Test / fuel (top off) generators and fuel tanks Postpone all IT maintenance projects Restore any temporary configured infrastructure (if possible) Replenish and stockpile material Notify vendors Identify pre-designed staging sites (if applicable) Notify mutual aid partners and public-private partners Reinforce the need to follow the restoration list in order Decide on pre-activation of EOC Pre-deployment of personnel / equipment is warranted

11 Response Information is King!!! Conduct damage assessment Get access to damage assessments from others Mine social media for damage information Engage Public-Private Partnerships Remember your employees If a weather event, their homes and their families may have been impacted. If manmade or terrorism, they will want to know so that they can assist their families, and you. Remember, Information is King!!! Regulators want information Partners need information for the situational awareness Customers and the public demand information Once extent of damage is determined; Determine what can be done with internal resources Determine what external resources will be needed As a utility: Timely response is essential for the community to recover! Your regulators, partners and customers need to know you are engaged

Restore Execute the prioritization list Remain versatile if circumstances require a reprioritization of order Implement Project Management processes Track assignments and material Track productivity

12 Restore Execute the prioritization list Remain versatile if circumstances require a reprioritization of order Implement Project Management processes Track assignments and material Track productivity and material use Identify where additional personnel and resources are needed Identify your material burn rates and forecast availability If any material will be exhausted, engage supply chain to resupply Communicate your progress (be honest) Provide regulator, partners and customer with the same information Restoration is about recovering the community.

Recover As the lights come back on, the water and gas flows into homes and business, and communications is restored, the communities that we serve recover.

13 Recover As the lights come back on, the water and gas flows into homes and business, and communications is restored, the communities that we serve recover. As utilities complete restoration, they need to release mutual aid personnel so that they can return to their communities. Documentation processes need to be in place to retain information related to the event for insurance and reimbursement purposes. Regulatory and Public-Private partners will be conducting After-Action Reports (AAR), so that we can all improve on future events. If weather-related or manmade, the focus will be on continued improvement. If terrorist-related, there will be a criminal investigation component to the AAR.

14 Any questions?

15 Speakers Contact Information Anthony Hurley, CPP, PCI, MEP Managing Director, Utility Practice Witt O Brien s, a SEACOR Company (216) alhurley@wittobriens.com LinkedIn:

16 Overcoming Threats to a Utility's Critical Infrastructure ASIS Global Security Exchange (GSX) Nicholas W. Santillo Jr. VP, Chief Digital Infrastructure & Security Officer

We provide services to approximately 14 million people in 45 states and Ontario, Canada.

17 WHO WE ARE We are the largest and most geographically diverse publicly traded water and wastewater service provider in the Unites States. We serve a broad national footprint and a strong local presence. We provide services to approximately 14 million people in 45 states and Ontario, Canada. We employ 7,100 dedicated and active employees and support ongoing community support and corporate responsibility. We treat and deliver more than one billion gallons of water daily. 17

18 Nicholas Santillo Jr. Speaker Bio 20 years in water utility industry (Physical & Cyber Security, Business Continuity & Incident Response) Current Chair ASIS Utilities Security Council (USC) Current Vice Chair of the Water Sector Coordinating Council Board Member Water Information Sharing and Analysis Center (Water ISAC) Board Member Rutgers Cybersecurity Advisory Board Incident Command System (ICS) Instructor

19 Emergency Preparedness Practices (G440) Explicit Commitment to Emergency Preparedness Preparedness Culture Defined Preparedness Roles and Employee Expectations Risk Assessment Preparedness Plans Internal and External Communications Training & Exercises Partnerships Prepare for the effect, do not attempt to manage the cause

20 Superstorm Sandy Impacts USAGE DECLINE POST SANDY (May-Oct In 1,000 Gallons) Reconstruction of over 20,000 feet of water main ranging in size 8 to 16 Utilized GPS and GIS to locate buried infrastructure Usage declines of 100% in some areas (2012 to 2013) 20

21 Challenges and Solutions Fuel Availability Partner with municipalities to share fuel services, Emergency Fuel contracts Backup Generation Permanent vs. Portable, ongoing maintenance, understand duty requirements Transportation / Blocked Roads Partner with Emergency Management Communications FirstNet, GETS/WPS, Satellite Phones Essential Skills Availability Pre-staged resources, Shared resources

22 Resources ANSI/AWWA G430-14: Security Practices for Operation & Management ANSI/AWWA J100-10: Risk & Resilience Management of Water & Wastewater Systems ANSI/AWWA G440-17: Emergency Preparedness Practices M19 Emergency Planning for Water and Wastewater Utilities Business Continuity Plans for Water Utilities Emergency Power Source Planning for Water Utilities

23 Speakers Contact Information Nicholas Santillo Jr. CPP, PCI, PSP VP, Chief Digital Infrastructure & Security Officer LinkedIn: THANK YOU

24 ASIS PRESENTATION: GSX CONFERENCE Mitigation, Preparedness, Response and Recovery September 24, 2018

operations Participate in state planning process Train with state

25 THE REGULATORS PERSPECTIVE Mitigation and Preparedness Develop relationships Educate private sector partners on public sector disaster operations Participate in state planning process Train with state regulators and emergency management agencies 25 HILLARD HEINTZE 2018 Protecting What Matters

THE REGULATORS PERSPECTIVE Response Have the capability to be responsive in regards to outage information Understand what resources are available from public sector partners Be aware

26 THE REGULATORS PERSPECTIVE Response Have the capability to be responsive in regards to outage information Understand what resources are available from public sector partners Be aware that regulators are interested in outage information to assist planning for entire response and recovery Communicate, communicate, communicate 26 HILLARD HEINTZE 2018 Protecting What Matters

THE REGULATORS PERSPECTIVE Recovery Continue to communicate restoration information Work with public sector partners to ensure there is unity of message Work with public sector partners

27 THE REGULATORS PERSPECTIVE Recovery Continue to communicate restoration information Work with public sector partners to ensure there is unity of message Work with public sector partners with special circumstances Be prepared to present a cumulative presentation about your organizations restoration efforts and lessons learned 27 HILLARD HEINTZE 2018 Protecting What Matters

THE REGULATORS PERSPECTIVE Threat-Specific Issues Challenges with security-sensitive information State regulators comfort level with what they do not know Experienced

28 THE REGULATORS PERSPECTIVE Threat-Specific Issues Challenges with security-sensitive information State regulators comfort level with what they do not know Experienced security/emergency management staff and cost Level of integration with fusion centers and state-level emergency management 28 HILLARD HEINTZE 2018 Protecting What Matters

QUESTIONS AND DISCUSSION Cody Mulla, MS CPP, AEM, CHPA, CHPP Director, Security Risk Management cody.mulla@hillardheintze.

29 QUESTIONS AND DISCUSSION Cody Mulla, MS CPP, AEM, CHPA, CHPP Director, Security Risk Management South Wacker Drive, Suite 1400, Chicago, Illinois HILLARD HEINTZE 2018 Protecting What Matters

Understanding Operations Center Implementation and Incident Command System Considerations

Understanding Operations Center Implementation and Incident Command System Considerations Webinar, October 17th, 2018 Presented by Matthew Dimmick, PSP, CPD STV Inc. Security & Resilience Services Anthony Hurley, MEP, CPP, PCI Witt O Brien s, a SEACOR Company Managing Director, Utility Practice