CRAIGLIGHTNER

SUPERVISORAUTOMATIONAND

CONTROL

2

2

TypesofNaturalGasCompanies

• GasProduction- WellHeadProduction,LandfillProduction,FrackingProduction

• GasTransportation- InterstatePipelines

• GasLDC- LocalDistributionCompany

2

RedundancyofService• Ourproductisourenergysource– Itpowersourgenerators– Itpowersourpneumaticbackupsystems

• Pipesareloopedmuchlikeacommunicationringnetwork

• WemaintainanindependentpressuremonitoringsystemnotconnectedtoourICSnetwork

EntitiesVyingtoRegulatetheNaturalGasIndustry

DHS– DepartmentofHomelandSecurityCFATS- ChemicalFacilityAnti-TerrorismStandards(DHSSubcommittee)

DOE– DepartmentofEnergyDOT– DepartmentofTransportation(Regulatestransportationpipelines)

FERC– FederalEnergyRegulatoryCommission(Regulatestransportationpipelines,anAdministrationunderDOT)

EntitiesVyingtoRegulatetheNaturalGasIndustry

PHMSA– PipelineandHazardousMaterialSafetyAdministration(RegulatesALLNaturalGasControlRooms,anAdministrationunderDOT)

NERC- NorthAmericanElectricReliabilityCorporation(RegulatestheElectricIndustry,CIPstandards)

TSA– TransportationSecurityAdministrationPSC– PublicServiceCommissionsAGA– AmericanGasAssociation

MethodsEmployedforSecurity

1. NetworkIsolation2. StaffSupport(OnSite,Vetted)3. NOUnescortedRemoteAccess4. NOfiletransportintotheinfrastructure5. Sanitizedtransportoutoftheinfrastructure6. NOWirelesscommunications7. Dailyvirussignatures

MethodsEmployedforSecurity

8. MonthlyOSpatching9. QuarterlyICSpatching10. EncryptedMWandRFtraffic11. VPNtunnelandCertifiedApplicationTraffic12. Eventandtrafficloggingwithanalysis13. Failovertothebackupsystemmonthly14. PracticeICPquarterly

MethodsEmployedforSecurity

15. PracticeBCPannually16. PracticeRegionalSimulationswithExternal

Resources(Fire,Police,OtherGasCompanies,FBI,DHS,Vendors,etc.)semi-annually

Challenges

1. WehaveaLargeTerritorywithexposedinfrastructure

2. Weareconcernedaboutthesupplychain3. Weareconcernedaboutinsidercapabilities4. Weareconcernedaboutpenetrationtesting

oftheproductionnetwork

Questions