Full Report
The U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) and Idaho National Laboratory... The post DOE, INL launch weekly series on cyber-informed engineering to advance cybersecurity in energy infrastructure appeared first on Industrial Cyber.
Analysis Summary
# Best Practices: Cyber-Informed Engineering (CIE)
## Overview
Cyber-Informed Engineering (CIE) is a specialized framework developed by the DOE and INL to shift critical infrastructure security from a purely reactive "network protection" model to a proactive "engineering out of consequences" model. It utilizes engineering design and physics-based controls to mitigate cyber risks at the earliest stages of a system's lifecycle, ensuring that even if a cyber attack succeeds, the most catastrophic physical outcomes are impossible.
## Key Recommendations
### Immediate Actions
1. **Access the CIE Learning Hub:** Register or visit the INL/DOE learning hub to begin the weekly series on the 12 foundational principles.
2. **Implement Principle 1 (Consequence-Focused Design):** Evaluate your system to identify the worst-case physical outcomes of a cyber incident and determine if engineering controls (e.g., mechanical pressure release valves vs. software-controlled valves) can prevent them.
3. **Download the CIE Analysis Tool:** Utilize the web-based tool provided by INL to track and document your organization's responses to engineering-security questions.
### Short-term Improvements (1-3 months)
1. **Pilot the CIE Implementation Guide:** Apply the guide to a single upcoming capital project or system upgrade to navigate engineering-specific security questions during the design phase.
2. **Cross-Training:** Facilitate workshops between IT/Cybersecurity teams and Engineering teams to bridge the gap between digital security and physical process safety.
3. **Review "Back-to-School" Case Studies:** Analyze the weekly DOE/INL case studies to identify parallels in your own energy infrastructure.
### Long-term Strategy (3+ months)
1. **Adopt the CIE Handbook:** Once released as the series capstone, integrate the CIE Handbook into your organization's standard engineering design manuals (EDMs).
2. **Transition to Engineering Controls:** Move away from relying solely on software-based firewalls for critical safety functions, replacing them with hard-wired, physics-based, or non-digital fail-safes where possible.
3. **Funding Procurement:** For rural or municipal utilities, apply for the RMUC Advanced Cybersecurity Technical Assistance funding ($100M pool) to support CIE adoption.
## Implementation Guidance
### For Small Organizations (Rural/Municipal Utilities)
- Focus on the **CIE Analysis Tool** to identify the highest-risk assets without requiring extensive consulting staff.
- Leverage the **RMUC funding opportunity** specifically designed for non-profit and small investor-owned utilities.
### For Medium Organizations
- Use the **CIE Back-to-School Weekly Series** as a structured, low-cost training program for existing engineering staff.
- Assign a "CIE Champion" to act as a liaison between the operations (OT) and engineering departments.
### For Large Enterprises
- Standardize the **12 Foundational Principles** across all global infrastructure projects.
- Integrate CIE requirements into the **Procurement and Supply Chain** process, requiring vendors to provide engineering-based risk mitigations.
## Configuration Examples
While CIE focuses on engineering design rather than software code, a typical "configuration" involves:
- **Mechanical Interlocks:** Configuring systems so that a physical state (e.g., opening a breaker) requires a manual, physical key turn regardless of the command sent via the SCADA system.
- **Physics-Based Constraints:** Designing piping or electrical components with physical capacities that prevent "catastrophic overpressure" even if software sensors are spoofed.
## Compliance Alignment
- **NIST SP 800-82:** (OT Security) CIE principles complement these controls by adding a layer of physical safety.
- **NERC CIP:** Supports compliance with Reliability Standards by reducing the impact of potential violations.
- **DOE CIE Framework:** Direct alignment with the 12 foundational principles of the National CIE Strategy.
## Common Pitfalls to Avoid
- **Over-reliance on "Air Gapping":** Assuming a network is safe because it is disconnected; CIE assumes the network *will* be breached and focuses on physical consequences.
- **IT-only Solutions:** Treating cybersecurity as a software problem rather than an engineering design challenge.
- **Ignoring Legacy Systems:** Failing to apply CIE principles during the maintenance or "refresh" cycles of older equipment.
## Resources
- **CIE Learning Hub:** [inl[.]gov/national-security/cie/principles/]
- **INL CIE Knowledge Hub:** [inl[.]gov/cie-knowledge-hub/]
- **DOE CESER Announcements:** [energy[.]gov/ceser]
- **Analysis Tool:** Web-based tracking tool for CIE principle application (available via INL).