National Laboratory Researchers Adapt Cybersecurity Tool for Hydropower

Researchers at Idaho National Laboratory (INL) worked with hydropower stakeholders to adapt for use in hydropower facilities an open-source cybersecurity tool developed by the Department of Homeland Security (DHS). This tool will help hydropower owners and operators better understand their facilities' cyber assets and improve network security. 

Cybersecurity has evolved as a serious threat over the past 20 to 30 years, but many hydropower facilities' systems predate those concerns. Additionally, many plant operators may not know what cyber assets their facility has, making it hard to build a set of cybersecurity policies, procedures, and guidelines. 

To help with these challenges, INL researchers adapted a DHS security tool called the Cyber Security Evaluation Tool, which provides a systematic, disciplined, and repeatable approach for evaluating an organization's security posture. In addition, INL researchers are working with a tool developed with the Bureau of Reclamation called Malcolm, which includes a suite of free and open-source software aimed at improving network security through passive monitoring and analysis of network traffic. Visgence, LLC also contributed to developing Malcolm, and CNK Solutions supported program development, communications, and industry outreach.

The INL team worked with hydropower owners to understand their challenges and streamlined the installation process for Malcolm and other existing cybersecurity tools so they can be readily deployed in hydropower facilities. The team also refined the hardware sensors to reduce costs and ensure they can withstand the harsh environments associated with mechanical infrastructure. The team further increased Malcolm's ability to integrate with other open-source software that helps identify hosts, software, cables, ports, and connections throughout a facility. Additionally, the team plans to create a document to help answer technical assistance questions.

These collective improvements have made Malcolm easier to use and incorporate into hydropower facilities, allowing owners and operators to better understand their security needs and protect their assets. The team will continue to collaborate with hydropower facility owners, refine the tool to increase usability, and incorporate additional DHS software and assessment tools. The project will also integrate with other renewable energy technologies through a cohesive program across the U.S. Department of Energy's Office of Energy Efficiency and Renewable Energy called Cyber SHIELD.