Engineering topics
Publications and source records attributed to Chanoski, Samuel Douglas.
This brief presentation provides a brief overview of Cyber-Informed Engineering (CIE), explains public resources available for CIE application, and reviews current efforts to expand CIE knowledge and use. To be presented to the NERC Reliability and Security Technical Committee at their annual in-person meetings in San Diego, CA.
The Bipartisan Infrastructure Law kick-started a surge in clean energy investments in the United States. Securing these systems and their supporting infrastructure from the outset is imperative, starting from the conceptual design and continuing through the entire engineering lifecycle. Cyber-Informed Engineering is an ideal approach to seamlessly integrate the necessary advanced control capabilities and adaptive protection systems, especially considering the trend towards cloud-based infrastructure and process controls. Learn more about CIE at https://www.energy.gov/ceser/articles/cyber-informed-engineering-bridge-between-cyber-and-critical-infrastructure-securing.
This case study workbook provides a hypothetical project to support discussion and application of the principles for Cyber-Informed Engineering. Participants in the workshop are encouraged to use the workbook to capture insights and lessons learned. The provided attachment to this workbook contains the visuals for the hypothetical project scope and is used by participants as they capture insights and lessons learned. Though some elements of this scenario are provided for consideration, there are likely key facts which have been omitted or may be unclear. Participants are encouraged to make any needed assumptions about the project to enable application of the CIE principles. Though this project is based on real-world case studies, it is fictional.
CIE is an emerging method to integrate cybersecurity considerations into the conception, design, development, and operation of any physical system that has digital connectivity, monitoring, or control. CIE complements—but does not replace—the application of cybersecurity standards or practices currently in place within an organization. Rather, it expands cybersecurity decisions into the engineering space, not by asking engineers to become cyber experts, but by calling on engineers to apply engineering tools and make engineering decisions that improve cybersecurity outcomes. CIE examines the engineering consequences that a sophisticated cyber attacker could achieve, and drives engineering changes that may provide deterministic mitigations to limit or eliminate those consequences. Engineers and technicians that design critical energy infrastructure installations can integrate the 12 principles of CIE into each phase of the engineering lifecycle, from concept to retirement. These principles are aimed at system or design engineers, operators, and technicians, rather than software engineers or operational cybersecurity practitioners, because the engineers who design, build, operate, and maintain the physical infrastructure are best positioned to leverage a system’s engineering design to diminish the severity of cyber attacks or digital technology failures. This approach creates new opportunities for engineering teams—and not just cybersecurity teams—to secure the system using the physics and mechanics of engineering controls—not just digital monitoring and controls.