Security Support

The vast majority of reported cyber incidents result from attacks that target known vulnerabilities in operating systems. In most cases, software updates and mitigating measures had already been published but had not been applied.

Timely patch management is thus a key requirement in ensuring the continued safe operation of control systems. For this reason, NERC CIP-007 R3 requires that utilities implement a Security Patch Management program for tracking, evaluating, testing, and installing applicable cyber security software patches for all Cyber Assets within the Electronic Security Perimeter.

Many of Cooper Power Systems products are based on Microsoft technology. Microsoft publishes security updates for its operating systems and applications on a regular basis. However, the deployment of a security update is a costly operation that can result in disruption of service. The decision that a utility needs to make is whether the cost of the update outweighs the risk faced from a potential attack stemming from an unpatched system.

As part of its program to help utilities meet NERC CIP requirements, Cooper Power Systems evaluates the applicability of Microsoft security updates to its products with the goal of providing utilities with a recommendation within 10 days of release.