Co-op Webinar: How to analyze grid impacts of EVs and Solar in just 10 weeks. Register now
Recent ransomware hacks on critical infrastructure have highlighted the need for increased security embodied by a Zero Trust approach to software and information technology. We want to share our perspective on Zero Trust Security and why we treat it as a core to our platform's security approach.
This is a frequent question from our friends at electric cooperatives and load serving entities, and the topic has become increasingly important after the Colonial Pipeline ransomware attack showed vulnerabilities in our basic infrastructure. In addition, the White House ordered electric utilities to meet voluntary cybersecurity performance goals. Not only are utilities tasked with safely and securely providing electricity to their customers without disruption, but they are also required to maintain SPII (sensitive personally identifiable information). There is no doubt they are targets. And since Camus Energy is tasked with providing software to utilities, it is only natural to ask: “Are you going to be as careful with our data as we are?”
Camus Energy’s technology leaders have a combined 80 years of experience working in the software industry, most recently at Google, SpaceX, and Uber. There, we refined a Zero Trust model to cybersecurity -- in order to trust, you must first verify. In plain English, this means:
Sounds simple, right? But the approach is different from the usual approach to defending a corporate network security that focuses only on keeping bad actors out. This is known as the “hard crust, gooey center” or perimeter-based model. Once you’re inside a network, you are assumed to be “safe”. Instead, every transaction between systems should be validated and proven trustworthy. These are the core principles of a Zero Trust approach.
Likewise, cloud computing technologies embody our approach to Zero Trust security. Each customer’s data and software instance resides in a different silo. No communication is ever allowed across those silos by default. In the unlikely scenario that an intruder gains access to one part of the system, it is much harder to extend or reach other areas.
Our cybersecurity approach also means maintaining contingency and business continuity plans. If there is a threat to shutdown systems or reveal access to data in order to extract payment, we maintain immutable backups of all our data. We can quickly restore data corrupted by any attackers. We also keep system blueprints in revision control, so we can reconstruct a new, pristine cloud environment within hours.
We are equally sensitive to “man-in-the-middle” attacks. These threats are a type of intrusion achieved through eavesdropping. Zero trust security ensures that any data transmitted between sender and receiver is encrypted. Authentication ensures the two systems talk only to each other and not intermediaries.
Credential theft is another type of third party attack on critical infrastructure. Stealing passwords, often achieved by constructing a fake login page, is probably the simplest type of attack as well as the most straightforward to defend. We require all users to maintain two factor authentication while also supporting single-sign-on through our customers’ identity provider. This allows the utility’s IT team to stay in control of the policy, including how often passwords must be updated.
Camus Energy takes the security of our customers’ data very seriously. In addition to our Zero Trust strategy we use a long tail of additional verification and mitigation tactics, whether scheduled access auditing, vulnerability scanning, penetration testing, thorough auditing, or through our current engagement to complete SOC2 compliance. Our full IT and Security Policy is available upon request.
