Kathy Gibson reports – South Africa’s energy infrastructure is expanding rapidly – but, in the absence of coherent cybersecurity policies, could be under threat.
This is the headline takeaway from a panel discussion featuring cybersecurity and energy experts, which urges direct and rapid action to prevent a potential calamity.
Martin Fernandes, business development manager: Africa, OT and IoT at Fortinet, points out the country’s energy sector is undergoing rapid transformation.
This includes the implementation of integrated digital technologies. “These have the goal of improving efficiency, but they also present significant challenges in terms of technology, regulation and security.
“Transformation must not only enable innovation, also preserve safety, reliability and regulatory compliance,” Fernandes says.
It’s easier to say than achieve, though, says independent energy analyst Chris Yelland.
The energy regulator NERSA is more focussed on pricing and probably doesn’t have the ambit or skills to regulate on the highly technical field of information technology (IT) and operational technology (OT), Yelland points out.
He believes the country needs to explore the formation of a new regulator, with power and authority clearly set out and enshrined in law.
Fernandes agrees that the lack of a single responsible energy security regulator, with no mandatory OT asset registers or incident reporting timelines, is an issue.
“This basically leaves everyone to themselves: everyone will do what they believe to be right, but they will be fragmented.
“What we need is to be more mandatory in terms of cybersecurity. We need timelines and the ability to ensure organisations are taking the issue seriously, and are doing what is necessary to secure the infrastructure.”
Although the IT industry has well-architected and proven cybersecurity defences, these cannot simply be copied and pasted into the OT environment, Fernandes explains.
An encouraging trend is that the chief information security officer (CISO) is increasingly becoming responsible to OT security as well.
But Fernandes stresses that, in some instances, IT protections could destabilise OT devices.
“There needs to be a broader approach than simply copying and pasting IT defences. They need to be tailored to the OT context.”
OT environments tend to be widely distributed, with many older components, which could result in an estate that is all but impossible to secure.
“So the shift we are seeing from cybersecurity to resilience becomes relevant,” Fernandes says.
Arguably the biggest obstacle the country faces in securing its critical infrastructure is a shortage of skills.
“We need to address the level of skills available in this highly technical and fast-changing field,” says Yelland. “And those skills need to be in the hands of the people on the ground – not just the OEMs or security companies.”
Change management is important, too, with a resistance to change often holding organisations back. “People do tend to be backward-looking to when things were simpler.”
Yelland recommends a two-pronged approach to the cybersecurity issue.
“We need a top-down approach that focuses on the regulatory framework and ensuring the right resources are in place.
“The bottom-up approach would involve putting in place the skills.”
Skills development will devolve to the universities and Technikons, which need to broaden and integrate their training, he adds.
Fernandes agrees, adding that cybersecurity must be a board-level concern.
“And it needs to be measurable,” he adds. “Typically the investment trajectory in cybersecurity trails the investment in digitalisation.”
Part of the reason is that it is hard to quantify a return on investment (ROI) for cybersecurity.
“A lot of organisations don’t invest because they haven’t been breached,” Fernandes says. “But they could have been – if they don’t have visibility they won’t know.
“They don’t see an ROI, right up to the point where they are breached.”