A Modern Threat

A Modern Threat

Utilities require state-of-the-art surveillance tools

Whether it is water, electricity, gas, oil or even telecommunications and transportation hubs, critical infrastructure facilities present unique challenges for security professionals. Threats against city utilities in North America have never been as diverse or real as they are today and ensuring the security for these vital backbones of a country's infrastructure is important.

Cyber Security Threats
Beyond physical attacks, combating cyber security threats and natural disasters also present an ongoing challenge for utility providers. Multi-billion-dollar economic losses are no longer the hypothetical scenario of an attack, but are relevant for short-term regional outages. Bad actors know that such facilities can give them maximum attention and as such, consider them prime targets.

The recent cyber-attack that forced a temporary shutdown of the Colonial pipeline, one of the largest in the United States, serves as a stark reminder of how damaging and ever-present such threats can be. Likewise, an earlier cyber-attack in Florida that sought to compromise a water treatment plant saw hackers exploit remote access software and compromise credentials. This might have been a classic case of human error with a single shared password, but it is up to security professionals to protect people from themselves regarding enforcement best practices and using techniques such as multi-factor authentication.

With technological development and the increasing popularity of ‘smart connected infrastructure’ comes the inclusion of networks that connect grids, pipelines and other critical infrastructure with multiple operators and databases, maximizing the potential number of entry points vulnerable to cyber-attacks. Utilities are at higher risk, since large numbers of attempted attacks occur every day.

Standards and Compliance
Because utilities are part of the critical infrastructure mix, they have strict regulations that must adhered to regarding security, with strict penalties and fines for any organization found out of compliance. As an example, the Federal Energy Regulatory Commission (FERC) and the North American Electric Reliability Corporation (NERC) are both involved in overseeing new standards that specifically address the physical and cyber security of all control centers, stations and substations throughout the country.

This can include compliance with specific standards such as the NERC CIP (Critical Infrastructure Protection) for electrical utilities. These standards specify how electrical utilities are to monitor access points, protect cyber-security assets and monitor the perimeter.

In particular, NERC’s CIP 014-2 and CIP Version 7 standards have the industry taking a closer look at security operations at facilities near and far. The CIP 014-2 standard calls all responsible electricity entities to identify their critical facilities, evaluate the security risks and vulnerabilities to those identified facilities, and implement measures to mitigate the risk of physical attack.

While CIP Version 7 is more oriented towards cyber-attacks, risk mitigation often involves physically securing substations and stations where Supervisory Control and Data Acquisition Systems (SCADA), and relevant servers and network switches are housed. Under these NERC standards, electrical service providers are required to meet phased mandates, each with penalty-subjected deadlines. Other utilities may have similar regulations with which to comply.

Any poorly protected IoT device represents an opportunity for a hacker to exploit the device and potentially gain access to an organization’s internal protected network. Since IP-based cameras, the VMS, NVRs and supporting infrastructure all communicate over the network, it is critical that the security system not be an entry point for cyber-attacks.

It is vital to have confidence in the security of each device on the network. With cameras, it is important to know as much as possible about the manufacturing process and the supply chain regarding the sourcing of internal components. What chipset is used, where was it made and who made it? Is it an OEM or white label product versus an actual manufacturer-developed and designed product?

There are important factors that can have an impact the underlying security of a device. IT professionals can do their best to secure the network, but, if they don’t know what’s going on inside the device, those efforts could be wasted. Utilities should ensure that cameras are NDAA (National Defense Authorization Act) compliant with well-established cybersecurity features such as secure boot, a trusted platform module and decryption keys that block nefarious code from being uploaded.

Perimeter Security
Depending on the type of utility, the perimeters can be large and may be in remote areas where network bandwidth may be limited. The challenge of protecting such utilities is complex and often requires multiple and varied solutions. Security measures require balance against efficiency and convenience for daily staff and shift changes, while contractors, especially those who travel to unstaffed areas of a site, may require temporary authorizations.

The perimeter consists of video and thermal surveillance cameras, motion sensors and lasers. Most cameras can deliver solid performance in daylight. It is more difficult for cameras when the light disappears. IR light is one answer, but most IR lights have a fixed distance of illumination and can make it difficult to discern details when color is lost. It is possible to choose cameras with extreme low-light sensitivity that can still provide reliable color information.

Cameras with a wide dynamic range (WDR of 120-150dB is ideal) that can consistently reproduce detail from shadows even in high-contrast lighting conditions are a necessity for many deployments. Frames per second (fps) can affect WDR performance, so it’s important to find a balance between fps and lighting requirements to deliver the WDR required without sacrificing smooth motion capture. AI-based algorithms can also reduce image noise by identifying object motion and reducing blur in low light environments. As camera resolutions go up, so does the required bandwidth to carry those images to a recorder, viewer or VMS.

Efficient codecs such as Hanwha’s Wisestream II compression technology and H.265 are used to transmit high quality images over 4G or LTE connections while minimizing infrastructure costs. Thermal cameras provide excellent long-distance perimeter coverage, especially in low light conditions and bad weather. To maximize coverage, multi-sensor cameras can be deployed which deliver multiple high-resolution images using a single PoE connection.

The ability for security systems to automatically hand-off positional data to long-range, vari-focal infrared PTZ cameras with auto-tracking can deliver usable video at distances of 1600 feet, even at 0 LUX. AI-based technology has made significant inroads by being able to detect objects and focus maximum video quality on detected objects in a scene while scaling back encoding on the rest of the scene.

AI-based analytics can significantly reduce false alarms along perimeters and within a facility with object detection, which never throws an alert for an animal or for wind-blown objects or shadows. That coupled with its ability to quickly produce results during forensic search, makes it a technology that should be an integral part of any utility security solution.

Protecting the security of utilities and critical infrastructure sites has never been more important in our ever-changing world. Threats against utilities are on the rise and the IoT connected world has given hackers and terrorists new entry points to exploit to their advantage.

To safeguard these types of facilities, both physical and cybersecurity practices protections must be upgraded to keep pace with evolving threats. Staying compliant with federal regulations not only ensures better protection, but it also avoids penalties and fees. Thankfully, the technology to protect utilities is also evolving in the form of high-resolution AI-based cameras and state-of-the-art cybersecurity features that make it harder than ever for bad actors to cause damage.

This article originally appeared in the November / December 2021 issue of Security Today.


  • 12 Commercial Crime Sites to Do Your Research

    12 Commercial Crime Sites to Do Your Research

    Understanding crime statistics in your industry and area is crucial for making important decisions about your security budget. With so much information out there, how can you know which statistics to trust? Read Now

  • Boosting Safety and Efficiency

    Boosting Safety and Efficiency

    In alignment with the state of Mississippi’s mission of “Empowering Mississippi citizens to stay connected and engaged with their government,” Salient's CompleteView VMS is being installed throughout more than 150 state boards, commissions and agencies in order to ensure safety for thousands of constituents who access state services daily. Read Now

  • Live From GSX: Post-Show Review

    Live From GSX: Post-Show Review

    This year’s Live From GSX program was a rousing success! Again, we’d like to thank our partners, and IPVideo, for working with us and letting us broadcast their solutions to the industry. You can follow our Live From GSX 2023 page to keep up with post-show developments and announcements. And if you’re interested in working with us in 2024, please don’t hesitate to ask about our Live From programs for ISC West in March or next year’s GSX. Read Now

    • Industry Events
    • GSX
  • People Say the Funniest Things

    People Say the Funniest Things

    By all accounts, GSX version 2023 was completely successful. Apparently, there were plenty of mix-ups with the airlines and getting aircraft from the East Coast into Big D. I am all ears when I am in a gathering of people. You never know when a nugget of information might flip out. Read Now

    • Industry Events
    • GSX

Featured Cybersecurity


New Products

  • A8V MIND

    A8V MIND

    Hexagon’s Geosystems presents a portable version of its Accur8vision detection system. A rugged all-in-one solution, the A8V MIND (Mobile Intrusion Detection) is designed to provide flexible protection of critical outdoor infrastructure and objects. Hexagon’s Accur8vision is a volumetric detection system that employs LiDAR technology to safeguard entire areas. Whenever it detects movement in a specified zone, it automatically differentiates a threat from a nonthreat, and immediately notifies security staff if necessary. Person detection is carried out within a radius of 80 meters from this device. Connected remotely via a portable computer device, it enables remote surveillance and does not depend on security staff patrolling the area. 3

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles. 3

  • Camden CV-7600 High Security Card Readers

    Camden CV-7600 High Security Card Readers

    Camden Door Controls has relaunched its CV-7600 card readers in response to growing market demand for a more secure alternative to standard proximity credentials that can be easily cloned. CV-7600 readers support MIFARE DESFire EV1 & EV2 encryption technology credentials, making them virtually clone-proof and highly secure. 3