Commitment reinforces the dual role of physical and cyber security
Natural gas utilities are striving to build security programs that ensure their cyber and physical security efforts complement each other.
“There is a growing recognition of the convergence of the two; that is, that a cyber incident would likely have ramifications on physical infrastructure, while a physical security compromise could result in cyber-related consequences,” Kimberly Denbow, American Gas Association’s security, operations & engineering services director, told American Gas. “This further ties into the need for corporate security and operations to collaborate, given the two have the same ultimate goal—ensuring the safe, reliable and cost-effective delivery of natural gas to the end user.”
That’s the message behind the AGA’s Commitment to Cyber and Physical Security, which was developed and adopted to demonstrate dedication to ensuring that natural gas pipeline infrastructure remains resilient in the face of growing and dynamic cyber and physical security threats.
Voluntary actions adopted by AGA members include implementation of the Transportation Security Administration’s Pipeline Security Guidelines and the application of the National Institute of Standards and Technology’s Framework for Improving Critical Infrastructure Cybersecurity.
“A leading impetus for the commitment is to increase awareness of the TSA Pipeline Security Guidelines and NIST Cybersecurity Framework, not just because they are smart practices, but to also demonstrate to TSA and Congress that gas utilities are proactive,” Denbow said. “Operators recognize that voluntarily implementing the TSA Pipeline Security Guidelines is preferable to broad-brush regulations that could limit the utility’s ability to assess and address its identified threat landscape.”
The commitment supports a risk-based approach to cyber and physical security. Risk and risk acceptance are company-specific. Denbow notes that this type of individualized approach is important to maintain.
The TSA is currently reviewing the guidelines to assess their practicality and relevance and identify any additional security recommendations. AGA is leading the effort on behalf of the natural gas and oil sector.