Energy / Utilities / ICS / OT Security Solutions

The threat of cyber-physical systems (CPS) attacks is increasingly evident across the critical infrastructure landscape, e.g. energy grids and industrial control systems, with the proliferation of successful attacks such as Sandworm, INDUSTROYER2.0, Triton, CADDYWIPER, and others. Motivations behind cyberattacks on energy infrastructure are generally linked to economic competition and strategic positioning between nation-states. As Distributed Energy Resource Management Systems (DERMS) worldwide strive to integrate more renewable energy, reduce carbon footprint, decrease cost, and improve optimization (ROI); industry continues to push more decision making (intelligence) to the edge (i.e. microgrids) through the use of digital sensors, increased bi-directional connectivity/communications, AI/ML, EV charging and smart meters, thus expanding the adversary’s attack surface.

Attacking energy critical infrastructure, adversaries are employing Tactics, Techniques, and Procedures (TTP’s) to blend in and act as legitimate traffic/protocols/domains by leveraging the functionality in these general purpose compute applications, operating systems, and industrial control systems. In the operational technology (OT) Supervisory Control and Data Acquisition (SCADA) environment, attacks are difficult to identify, prevent, and respond to due to a lack of threat data, real-time operating systems, and resource constrained environments. These deficits challenge the current NIST Cyber Security Framework (CSF) paradigm of Identify, Protect, Detect, Respond and Recover because common monitoring and detection systems rely on looking for abnormalities and/or signatures associated with prior attacks. While the proliferation of “Known Unknowns” is predictable, cybersecurity analyst reliance on AI/ML to sort through the massive amounts of data to find adversary activity will increase – analysts are constrained to the application layer, the need for the collection of massive amounts of data, the computational resources adequate to support, and the inherent statistical probability of no detection . Most attacks and system infiltrations begin between 45-95 days prior to detection. Ransomware and other attacks are now frequent with increasing economic and national security implications.

In accordance with Executive Order 14028, BedRock Systems designed and built a formal methods proven unbreakable trusted virtualization platform with active security™ that provides feature capabilities to countermeasure next generation Advanced Persistent Threats (APTs). BedRock Systems follows the Zero Trust (ZT) Model to “Deny All Allow by Exception” and extends the concept of Least Privilege to Least Functionality. Least Functionality enhances the NIST Cyber Security Framework category of “Protect” with “Prevent” while also providing a Zero Trust policy enforcement point. Through a combination of finer grain segmentation, segregation, isolation, maintenance of kernel integrity, and denial of functionality, BedRock Systems stops attacks that others cannot. BedRock Systems’ virtual introspection and logging of events in the compute stack provides situational awareness and policy enforcement, complimenting SIEMs, Firewalls, Software Defined Networks (SDNs), and other ZT architecture elements.

Energy and Utilities Use Cases

Grid & Substation

Choose the Only Preventative Cyber Secure Solution. Use BedRock Systems to build a secure future for your power generation, transmission and distribution systems. Utilities across the U.S. are digitizing operations and enhancing the interconnectedness of their systems to gain efficiencies and include the growing demand for renewable resources. Due to these enhancements, cyberattacks on energy infrastructure are escalating in quantity and sophistication. Recent government mandates and executive orders are trying to address these growing problems. BedRock Systems helps proactively fight against attacks. BedRocking Industrial PCs in the COMM and Security panels would greatly help the locking down of each substation. BedRock Systems is collaborating with several Power Manufacturers to propose this IPC strategy.

BedRock Systems’ policy technology helps document cyber-attacks attempts and shares information with the existing SCADA system. Historically, the NIST Cybersecurity Framework (CSF) featured five core functions: Identify, Protect, Detect, Respond, and Recover.

Now, it is time for more focus on a sixth function: prevention mechanisms to counter the risk of zero-day exploits. The concept of least functionality does this on a broader basis, as a key characteristic of this mitigation strategy’s approach to ZT is preventing actions before they execute.

Renewable Systems

Renewable energy is resulting in a substantially increased number of endpoints, sensors, controls, fault detection/response, and overall complexity of the grid. The implementation of smart meters, EV Chargers, and the need to transact bi-directionally on the grid is contributing largely to the complexity and threat surface of the modern grid.

Microgrid and hybrid power plants are relatively new players in the energy grid and are part of its transformation to a smart grid. With larger penetrations of Distributed Energy Resources (DER) and renewable energy as a growing portion of the global energy mix, the challenge of intermittent generation arises. These systems incorporate both Enterprise (IT) command and control as well as OT (Edge) elements. They also have a higher likelihood to be connected to the public Internet because they may be installed behind the meter with many of the monitoring and controlling of these assets online or wireless via encrypted bi-directional communications. These microgrids can also provide ancillary services to the grid such as Open Automated Demand Response with the electronic platforms that service these DER-based systems and provide communication channels between the utility and customer.

As the interoperability of smart micro-grid architectures look more towards local generation and distribution to optimize the use of sustainable renewable energy, we are pushing more of the decision making to the edge incorporating sensors, AI/ML, smart inverters, customer/stakeholder interfaces, bi-directional communication, and control algorithms. These systems’ availability and resilience rely on the protection of the data integrity and system critical components. As mentioned previously, these systems require both IT and OT capabilities for daily operations, command and control, and transacting with the business/financial supporting systems. BedRock Systems’ trusted virtualization architecture enables integration/convergence of both IT and OT systems applications, protocols, and operating systems (including RTOS). This is an essential element to converge these functionalities economically in these next generation grid architectures.

BedRock Systems recently demonstrated its ability to secure Software Defined Network (SDN) connected critical assets using its trusted virtualization and active security™ platform to stop ransomware, kernel integrity, root kit, and other attacks that traditional monitoring and detection systems do not. BedRock Systems has been working closely with NCCoE as an NCEP, as well as Florida International University, STAT-EI, and other leading institutions and the energy sector eco-system to enhance the availability, flexibility, sustainability, and scale-ability of these systems to the national level. Projects include: Securing the IIoT – Cybersecurity for Distributed Energy Resources (SP-1800-32), Micro-Grid Interoperability Guidelines, and Secure Inverter.

Inverters & Microgrid Protection

With the continued expansion of microgrids across the US and more intelligent devices being installed on the edge; cyberattacks are becoming a serious threat to those who do not apply BedRock Systems. BedRock Systems’ platform and policy generator promotes Least functionality, which is similar to the concept of least privilege, but with a focus on functionality (or constraining in a similar way what a device or application is allowed to do). Most architectures contain operating systems, applications, and processors that are designed for general purpose computing to promote interoperability and large market access. For least functionality, architectures would need to be intelligent enough to execute only the tasks or work flows necessary to perform a specific function or set of functions required to satisfy and reinforce the least privilege of a user, and nothing more. Many operating systems and applications have much more capability than is necessary, which is inherently a cybersecurity concern, so further restricting and containing what an OS or application or piece of hardware can provide the defender with an extra tool in the ZT toolbox to further reduce and microsegment the attack surface, making it much more difficult for an adversary to exploit such ZT solutions.

Organizations leveraging BedRock Systems’ trusted virtualization platform with Active Security™ can isolate, secure, and implement least functionality through Virtual Machines (VMs) that run on a formal method of proven trusted computing base. Leveraging a capabilities-based model, each VM operates with an independent and isolated Virtual Machine Manager (VMM) that implements policies to constrain the VM functionality. This fine-tuned control of VMs to constrain access to the exact resources necessary to execute tasks specifically defined in the system’s design is unique. Using this approach, organizations can establish both least privilege and least functionality policies that strip out all unnecessary functionality that an adversary can target and manipulate. Previously, organizations were forced to rewrite operating systems or redesign specific applications–both at great expense and business risk. Embracing this new approach would allow the implementation of least functionality for users running modern software and applications completely unmodified on top of BedRock Systems’ trusted virtualization and integration framework.

BedRock Systems is currently teaming with several government agencies (NIST, NCCoE, and MITRE) in the effort to define possible Smart Inverter Cybersecurity Guidelines. BedRock was recently announced as a NIST NCCoE NCEP Partner. This program is an ongoing collaborative partnership between US companies and NIST’s NCCoE with the potential to advance the state of cybersecurity practice.

Oil & Gas Gateway Solutions

In the oil and gas market, consolidation is happening everywhere. Since the pandemic, oil companies have been spinning off large unprofitable parts of their business while giving other companies the opportunity to acquire and become new market leaders in vertical sectors. Through this consolidation, attrition and loss of tribal knowledge have given companies the need to cross train IT personnel with OT cybersecure responsibilities.

It’s time for IT leaders to evolve their approach to cybersecurity, away from the defense-in-depth mindset to the ZT model. As the American Council for Technology-Industry Advisory Council defines it, ZT provides a security strategy for users to access data and assumes a “never trust and always verify” stance to require continuous authorization, thereby increasing visibility and analytics across a network.

Simply stated, ZT is an approach in which no user, device or application is implicitly trusted on the network, and whereby each network connection is a resource to be validated on a case-by-case basis. This continuous authentication and validation means users only obtain access to what they need to do their job, and nothing more – a concept known as “least privilege.”

As an example, in many traditional cybersecurity architectures, role-based access controls are widely accepted. This allows adversaries to take advantage of a larger domain of access once they are in a system as they can navigate within the architecture to escalate privilege and obtain additional credentials to exploit access control. With a ZT mindset, access control is defined down to a specific individual and their specific request (based on least privilege) to the network at the time they are connecting. By narrowly defining identity and ensuring tasks are constrained to least privilege, a ZT approach enables the continuous monitoring of access based on identity and authorization.

BedRock Systems is using this ZT model in a new approach to secure edge devices. BedRock Systems is collaborating with multiple passive cyber security software solutions to provide them the ability to proactively prevent attacks from spreading. This will give users the best way to lock down their assets in Upstream, Midstream, or Refining applications.

September 29, 2022

Developing with Formal Methods at BedRock Systems, Inc.

The BedRock HyperVisor is a commercial, highly concurrent, verified virtualization platform that employs formal methods to enable proofs of complex, lock-free concurrent code; support automating...

December 20, 2021

How To Enhance Zero Trust – ZT

Zero Trust – ZT relies on mutual authentication, verifying the identity and integrity of devices whether they exist inside or outside the network, and providing...

November 18, 2021

A Case for Lightweight Interfaces in Coq

This paper provides an overview of Coq, including three approaches and their advantages and disadvantages.

November 9, 2020

BedRock Founders Perspective

October 28, 2020

The BedRock Approach to Trustworthy Systems

October 16, 2020

How to BedRock Your Traditional and Distributed Energy Resources

A nation's infrastructure is worth protecting, learn how to add BedRock Solutions to your traditional and distributed energy resources. Also, review various approaches to BedRocking...

October 15, 2020

Formal Methods Defined from an Academic POV

October 14, 2020

Trusted Computing Base Edge to Cloud for Government

A Foundation for Cyber Resilience & Zero Trust

Safe & Secure Software-Defined Anything (SDx)

Software-defined is the future of infrastructure, bringing scalability and innovation to critical markets like utility and energy. Our bulletproof virtualization and separation software layer allows for innovation while under attack, with policy for communication and resources at the hypervisor level.

Secure Application Platform

Businesses across the energy and utilities sector are now producing apps to help customers manage consumption more efficiently. Unfortunately, web apps are a notorious target for cyber-attackers looking to exploit vulnerabilities and steal data. BedRock provides a secure platform for these applications, ensuring the privacy of user data.

Secure Cloud Infrastructure

The Commercial Facilities Sector includes a diverse range of sites that draw large crowds of people for shopping, business, entertainment, or lodging. These are based on the principles of public access, but are privately owned and operated. In order to reduce cost and better scale convenience functions, more and more automation and cloud based systems enter this market. At the same time, this also requires the applications to run securely and separately, while depending on communication.

Virtualization in the cloud and on the edge can reduce operational expenses and make information sharing easier. It also puts applications at risk of exposure if not executed with care. The BedRock Hypervisor enables organizations to run critical applications and securely store data on the cloud, even if cyber-attacks are attempted.

Secure Healthcare Cloud Infrastructure

More healthcare organizations are migrating their data to the cloud. While virtualization can reduce operational expenses and make information sharing easier, it also puts protected health information at risk of exposure if not executed with care. The BedRock Hypervisor enables healthcare organizations to run critical applications and securely store data on the cloud, even if cyber-attacks are attempted.

Secure Mobile Devices

As mobile devices become more commonly used in healthcare services, threats to protected health information increases. Security-conscious mobile devices can be built and maintained when based on the BedRock Hypervisor. We ensure that security, availability, and integrity are guaranteed, down to the resource partitioning of hardware devices involved in securing the different operating modes of the device.

Secure Edge-to-Cloud Virtualization

The transportation industry relies on edge computing to log data collection where connection to the cloud isn’t always possible. Trains, for example, have event recorders to log data that can be used to investigate accidents or explore operational efficiency. This information can then be sent to the cloud, when possible, to be stored or analyzed. BedRock Systems provides virtualization from edge to cloud, ensuring data is secure across infrastructure.

Secure PTC Backend Infrastructure

Positive Train Control (PTC) monitors and controls train movements to improve railway traffic, but it also creates a critical infrastructure cybersecurity risk. The BedRock Hypervisor provides an extra layer of protection for the PTC wireless communications network beyond existing encryption keys. This further minimizes the opportunity for malicious attack and theft of sensitive data.