Matching Cyber Security with Reliability and Maintainability: An Example on Power Systems for Data Networks

Since the beginning of the automation era, back in the 1980s, the Industrial Control Systems (ICS) has shown a growing demand for computers and communications resources to meet the productivity expected by the society. This growth was immensely leveraged by the internet and nowadays is not unusual that companies have their core systems accessed from anywhere in the world. The advantages brought by the use of this equipment create vulnerabilities that can be exploited by malicious activities that can seriously affect their core business. This new menace is called cyber-attack. Today companies and institutions need to find the breakeven between the computer resources used to increase their productivity and the threats that these resources could bring to the business performance. One of these threats is the remote shutdown of the power sources (usually called Uninterruptable Power Sources - UPS) that power the data network equipment. Depending on the loss of information such situation could be catastrophic to the business. To eliminate this threat a new schema was implemented. It is based on the nonuse of the UPS remote supervision features. Instead of this, extra UPS were installed in the equipment racks to work as ready-to-use spares, but without loads. The extra power sources supervision would help in the maintenance decision-making related with the assistance outside the normal office hours. The disconnection of the main UPSs from the network has not only improved the cyber security but also eliminate the time spent with the passwords management. This work is based on the recommendations of the United States National Security Agency and will be shown a case study in a Brazilian Electric Power Utility. Beside immediate practical results in the maintenance routine, there are some general lessons that will be perceived along the text.