Cybersecurity is essential to protecting Alberta's critical infrastructure

When a water utility starts a pump or a pipeline operator opens a valve, technology translates instructions into something happening in the physical world. Protecting these systems, known as operational technology or OT, is a cybersecurity challenge with consequences for the services Albertans depend on every day.

"We work with the systems that are often running quietly in the background," Jeremiah Hannley, CEO of Streamline Control, said. "These are the systems that keep the lights on, the water flowing, and the fuel pumping."

While information technology handles things such as emails and spreadsheets, operational technology starts pumps, reads temperatures and pressures, and helps keep a process within safe limits. It includes equipment in the field, the screens operators watch in control rooms, and the networks connecting them.

Jeff Gill, Director of OT Cybersecurity Services at Streamline Control, said keeping systems available is a central concern in OT. "You want everything to keep running," Gill said.

An attack might affect how equipment behaves or make the information on an operator's screen unreliable, Hannley said. A company may have to shut down an operation because it can no longer trust what it is seeing. The increasing connectivity of industrial systems also presents a challenge.

"In the IT world, most of the devices that are connected to a network are pretty up to date. You're unlikely to be more than a couple versions out of date," Gill said. "In the OT world, attackers are taking advantage of vulnerabilities that are created through old and unmanaged devices."

"All the management of software and firmware of those devices out in the field is much less governed than it would be in an IT environment."

Industrial systems are becoming more connected because organizations need information about how their operations are performing. Hannley said this can involve private networks, rather than equipment connected directly to the internet. Those connections still need protection.

"A lot of attacks actually start on the business side or the IT side. That's a way to penetrate a target through phishing, stolen passwords, or maybe compromised vendor remote access. And then the attacker moves towards operations," Hannley said.

He sees particular relevance for Alberta.

"Alberta in particular is a home to a large share of Canada's critical energy infrastructure. It's definitely a target," Hannley said.

Assuming industrial equipment will escape attackers' attention can leave organizations exposed, Gill said.

"I'd say the biggest misconception that people have is that these are obscure devices that nobody really pays much attention to. The fact is there are many, many people who are making a living off of trying to exploit those systems."

That means looking beyond the control room. Gill has encountered organizations with strong control-centre security but less protection at field locations. Protecting those systems requires cooperation between IT and operations, with each team bringing knowledge the other needs.

"It's both sides of this fence. IT and OT are both learning. IT is learning about what operations and OT means and OT is learning about what good security practices are," Hannley said. He suggested executives should own and sponsor that work, with day-to-day responsibilities handled by the appropriate teams.

For organizations wondering where to begin, understanding their equipment comes first.

"You start by finding out what you have. You can't protect and secure what you don't know exists. So that's the kind of first conversation we have with our customers. We want to understand your operation, what your concerns are, and what keeps you up at night," Hannley said.

Gill also recommends examining how employees and vendors access systems remotely, and planning what people would do if an attack occurred. An incident response plan gives teams a clearer understanding of their responsibilities when something goes wrong.

Streamline Control can turn those conversations into an assessment and recommendations on network design, secure access, and incident response. The company also helps implement security tools and can provide ongoing support, bringing cybersecurity into the work of keeping critical systems running safely and reliably.

Wondering where your organization stands? Find out how Streamline Control can help.