It is also important to ensure new software tools and updates are performed through authentic sources. For instance, a software could be available on websites that allow downloading various softwares. They might ask to provide their own downloader tool. If their downloader tool is installed, they might access that computer and network where the downloader is installed. Similarly, it is important to connect devices with official internet connection. A laptop (in particular) should not be connected to any random open network.

NERC requires entities to have written policies and procedures to keep EMS/SCADA systems up to date. Typically this includes secure downloads of patches from secure sites, often provided by the EMS vendor. Patches are to be tested and approved before being released to entities. Downloads are placed in a sandbox for scanning before moving into the CIP electronic boundary. Patches are typically installed in a test environment and function verified before moving into the operations environment. All operations must be documented and available to NERC at the next periodic audit.

I think power system software should be updated mainly if there is a safety issue. I am cautious with updating for the following reason. The European power grid, for example, has outages when there is suddenly 4 to 5 GW of power missing or too much. Imagine a company sells ovens for the kitchen and gives you an app to switch on your oven before you get home. If this app is updated often, a hacker is more likely to be able to hack it so that all ovens of that brand start baking in sync at a certain date and time. Good luck! Such an app is part of the power system software in one way or another...

Since firewalls can be penetrated, (hacked or mis-configured or have a vulnerability) I would look into data diodes for critical systems so they can send data out and don't have a path to send malware or allow hackers in.

Data diodes my be useful on plant DCS systems, but EMS/SCADA OT is too tightly interconnected with business IT for such limited communications. Fortunately the EMS/SCADA vendor will likely already have systems in place in their package to move data between the secure OT and the business IT systems. Firewalls in these systems are generally several layers and use the most advanced firewall technology available. Palo Alto Networks is one example of these advanced Firewalls. Again documentation is required for NERC compliance.

I have found it helpful to have several layers of backups, like a local USB drive backup, backups to network attached storage, and offline copies of backups at least 6 months old. In case one backup device fails or ends up with malware on it, you can still recover your systems.

EMS/SCADA typically employ a encrypted backup sever, generally a virtual machine with a raid array and an offsite mirror VM with a similar raid array. Additionally most EMS/SCADA will have two VM server arrays, one running in standby for a hot auto fail-over. Then a third offsite backup operations center with a third VM array running in standby for a hot site fail-over.

NERC requires a written policy that outlines the CIP physical protection boundary. The policy will include positions that have access, entrance and egress control and monitoring. Escort policies for non-motorized personnel. Nerc requires an auditable record be kept of entrance and egress of the physical boundary.

NERC has specific training requirements for identified positions with required completion dates. As always documentation is required.

One thing I like about ETAP software is the fact that they are certified by the nuclear industry. They go through a rigorous approval process, and I love that. It makes me feel secure when I use them