ICS Cybersecurity for a Major U.S. Hydroelectric Dam

The nation’s major hydroelectric dams not only make up some of the largest power generation facilities in the country—they’re also responsible for controlling the flow of rivers and curtailing flood and drought risks. Like most critical infrastructure and industrial facilities, these dams rely on a complex web of interconnected sensors, systems, and machines to keep them running. If these systems were taken down, whether by accident or by deliberate means such as a cyber attack, the results could be catastrophic. Imagine massive flooding, droughts, and power outages, millions of dollars in damage, and daily life in major cities grinding to a halt.

While the Federal Information Security Management Act (FISMA) requires all federal facilities to annually report on their efforts to continually monitor the security of their systems, critical infrastructure systems require a unique approach. When the agency that runs a hydroelectric dam that meets a significant portion of the electricity needs for an entire U.S. region needed a partner with the necessary expertise to assess the cybersecurity posture of its systems and help it meet its FISMA reporting requirements, Booz Allen stepped up.

Booz Allen was not the first partner the agency worked with in its effort to better understand its cybersecurity risks. Beyond meeting FISMA’s reporting requirements, it wanted to truly understand its facilities’ cyber attack surface and how best to protect it. Other consultants and contractors had performed cybersecurity risk assessments for the agency, but the results were not sufficiently thorough.

These previous contractors were simply not knowledgeable enough about industrial control systems (ICS) cybersecurity to meet the challenge. The search for a partner with the necessary expertise brought the agency to Booz Allen.

Booz Allen employs a large pool of diverse cybersecurity talent, including many individuals specifically focused on and knowledgeable about operational technology (OT) and industrial control systems. From these professionals, we assembled a team that partnered elite cyber experts with engineers who have decades of experience designing and running OT. Facing a truncated timeline, and fully aware that others had failed to meet the client’s exacting needs, we rolled up our sleeves and got to work.

Traditional IT systems can frequently be taken offline for vulnerability testing and patching during off hours. The demands placed on the OT systems that run our nation’s critical infrastructure mean downtime is hard to come by and a light-touch is required. In the case of a hydroelectric dam, OT systems directly control critical functions such as water flow and turbine speed—things that must be precisely maintained 24 hours a day. Our team’s insights into these and other challenges unique to OT proved critical to our work at the dam.

In just 5 weeks, our risk assessors, ICS specialists, physical security specialists, and project managers conducted a full range of cybersecurity assessments that normally would have taken 4 to 6 months. The results they produced included a prioritized list of the dam’s vulnerabilities, and recommendations on how to address them—much more than what was necessary simply to meet the client’s FISMA requirements. Impressed, the client invited us to help correct the vulnerabilities that the assessment detailed, meaning we get to continue doing work that helps keep the lights on for millions of Americans.