Focus on Cybersecurity

Best Practices in Cybersecurity: Dominion Virginia Power

Like many large corporations, Dominion Virginia Power has witnessed a growing need for cybersecurity in recent years, said Marc Gaudette, Director of IT Risk Management, Dominion.

"We have all of the typical functions of a cybersecurity organization that you would find at any large corporation, including folks who write policy, who manage compliance, and technical folks who administer security on a day-to-day basis, such as a firewall administrator," he said. "It's what's needed to protect our operating assets, our customers, and our employees."

Gaudette explained that many of the cybersecurity jobs at Dominion fell into a category he called the Information Security Analyst Family, which includes a wide range of roles all necessary to keep Dominion's hardware, software, and physical plants safe from cyber and other security threats. Also included in the range of cybersecurity jobs are security architects who design security plans, database administrators, and software systems engineers.

But cybersecurity is also a part of everyone's job at Dominion, he said, regardless of job title. "We want all of our employees to comply with the policies we set," he said. "There's an old saying that 'you are only as good as your weakest link, and humans are often the weakest link.' We want every person employed at Dominion to follow certain rules, like routinely changing passwords. They also need to inform us of anything they see that's suspicious, or if they implement any new technology so we can make sure it's secure. If they are not following our policy, then our protection gets weakened."

Finding people qualified for cybersecurity jobs is often complicated. In addition to possessing cybersecurity skills, they need to have a foundation in other technology as well, such as database administration or nuclear power. "It begins with a technical understanding of what we are trying to protect in the first place," Gaudette said. "Sometimes we take people with a good foundation in one area and then grow them to develop the cybersecurity skills on top of that."

Using himself as an example, Gaudette noted that he has a degree in marine engineering and had spent most of his career in nuclear engineering. "So I have a good understanding of industrial control systems, nuclear generation, and the technical aspects of transmitting and distributing power and the risks that go with it. That helps me understand how to protect it."

When recruiting for cybersecurity jobs outside of the company, Dominion looks for people with degrees in information systems, computer science, and computer engineering; who have business and management skills; or who have worked in network defense with the military or other federal agencies.

That's also helpful when working with federal and law enforcement partners who handle threat intelligence, Gaudette said. "We try to stay abreast of threats to the industry and broader threats in general to security."

For example, federal agencies may pass on specific IP addresses of cyber attackers who have been threatening utilities or other organizations so that Dominion can be on the lookout. In the reverse, Dominion will inform them if its cybersecurity staff detects hackers or people who act suspiciously around the utility's network perimeter. Gaudette likened it to the way a homeowner might call the police if he or she detected someone suspicious in the neighborhood. "That's of interest to law enforcement."

<Back To Top>

EPCE Partners with Excelsior College to Offer Online Cybersecurity Programs

The Energy Providers Coalition for Education (EPCE), a national alliance of energy providers and education institutions, has partnered with Excelsior College to help meet the utility employment demand for cyber professionals by providing a wide range of online cybersecurity programs, including a free massive open online course (MOOC) that teaches the basic concepts of cybersecurity and security.

"Now more than ever, cybersecurity is on everyone's mind. Energy companies need cybersecurity professionals, and because the programs are online, they are available to individuals throughout the nation," said Christine Carpenter, Director, EPCE. "This program has an outreach capacity to all utility workers in the United States, which is one reason we partnered with Excelsior College."

Carpenter noted that to help address the cybersecurity skills gap, Excelsior College offers a wide range of educational options in its online cybersecurity program, including the introduction to cybersecurity MOOC, certificate programs at the undergraduate and graduate levels, and bachelor's and graduate-level degrees in cybersecurity specializations.

"We realize that there are professionals in Information Technology (IT) who are dealing with complex issues to safeguard the nation's utility infrastructure and they may benefit from gaining more knowledge and skills to handle these emerging utility needs, as well as people who are brand new getting into this field," she said. "We partnered with Excelsior College because they offer such great online options for individuals at all levels to build their careers in this important field."

Program options include the free MOOC, which offers an introduction to cybersecurity. The undergraduate degree in cyber operations helps students understand industry standards as well as some procedures for identifying and detecting cyber attacks. The curriculum provides a more complete understanding of the details of cybersecurity operations, teaching students how to identify, assess, and respond to cyber attacks that threaten national security or the energy infrastructure.

At the graduate level, the program helps individuals become leaders in the field of cybersecurity. Some of the components include IT risk assessment, cybersecurity law and regulations, as well as cyberterrorism related to the energy industry. Excelsior College also offers a Master of Business Administration in Cybersecurity Management.

The online courses include simulations and online lab work at both the undergraduate and graduate level.

The MOOC is open to educators, professionals, the general public, and companies that want to use the course to train employees. Carpenter said people who take the online courses at various levels come from a range of positions in the energy industry, including people in traditional IT jobs, those focused on North American Electric Reliability Corporation (NERC) standards, and executives who want to better understand how cybersecurity impacts the energy industry.

"You'd think it would just be IT staff but it's really larger than that," she said. "There's a much larger interest in what cybersecurity means and how to protect our nation's energy infrastructure."

<Back To Top>

Estrella Mountain Explores Need for Utility-Focused Cybersecurity Degree

Estrella Mountain Community College (EMCC) already offered a few courses in cybersecurity when a local employer, struggling to keep entry-level IT employees in their positions for more than six months, came to them and asked if they could create a two-year degree specific to utilities.

Serendipitously, an EMCC student who was getting upskilled at the time for her job at the Department of Energy mentioned she had a friend with expertise in that very subject matter. Not only had Michael Echols written a book on the topic--Security for the Smart Grid--he lived across the street from the college.

"It was an amazing stroke of luck," said Clay Goodman, Vice President for Occupational Education, EMCC, the lead college in the Arizona Sun Corridor-Get Into Energy Consortium. "What are the chances of finding someone with the precise expertise you need right in your own backyard?"

So EMCC hired Echols as a subject matter expert to write curriculum for the program, which was funded by a federal employment training grant (the Trade Adjustment Assistance Community College and Career Training Grant, or TAACCCT).

"Every organization has a need for some kind of cybersecurity," he said. "Somebody needs to make sure that data stays intact and nobody can hack into your systems."

Goodman said a program is being designed for people who wish to work for utilities, but can be applied more broadly to other fields as well. Students who graduate from the program would be qualified for entry-level positions in IT, ensuring the security of data, building filters, tracking malware, and other tasks related to managing the security of a utility's infrastructure and network.

Goodman noted that EMCC is one of a handful of colleges in the western United States that offer a Red Hat Academy, where students learn the operating system used by the U.S. Department of Energy to manage the electric grid (Red Hat Linux). "So, our students are not only getting a solid cybersecurity background; they are learning it with the operating system they'll use in the industry," he said.

Because they would be graduating with two-year and not four-year degrees, they would be less likely to leave those jobs as quickly, though they would still eligible for an upward track within the company, Goodman said. "Right now, people are coming in with four-year degrees and understandably don't want to stay in these jobs very long. Hopefully this will create a better match."

EMCC's program would be offered both online and in the classroom. Some classes are already open to students, but the full program is still under review. For more information, please visit http://www.estrellamountain.edu/programs/information-technology.

The Department of Labor Cybersecurity Competency Model can be found here: http://www.careeronestop.org/CompetencyModel/competency-models/cybersecurity.aspx.

<Back To Top>

Troops to Energy Jobs Registration Site Now Available for Companies and Veterans

CEWD is pleased to announce an addition to the Troops to Energy Jobs website. It is a Registration Site that will allow veterans and active military personnel who are close to exiting the service to register basic information in an online database. This database will also contain information about companies who have jobs that match their skills. Veterans can enter the skills, training, and experience they have received while in the military and upload a resume. Veterans can also indicate the geographical locations in which they are interested in working. Companies can enter recruiter contact information and their company locations. Veterans will be able to see companies that are located in their areas of interest. Companies will see a list of veterans and be able to download their resumes.

CEWD is asking that its member companies go onto the Registration tab at www.troopstoenergyjobs.com and enter their company information. Consortia members, including contractors and suppliers, are able to register their information as well. CEWD would also encourage its members to demonstrate the Troops to Energy Jobs website during recruiting events and work with their military partnerships to have veterans register.

CEWD would like to thank American Electric Power for its sponsorship of this new site and its focus on military recruitment, hiring, and retention.

<Back To Top>

What We’re Reading

A Stronger Nation Through Higher Education
Source: Lumina Foundation

Hard Work, High Demand
Source: Inside Higher Education

Coached Through College: Professional Motivators Decrease Dropout Rates
Source: Time Magazine

Community Colleges Plan to Offer Quick Competency Degree
Source: The Seattle Times

<Back To Top>

Upcoming Events

Midwest Regional Meeting
June 18, 2014
Kansas City, MO
Register

National Energy Education Network
June 19-20, 2014
Kansas City, MO
Register

WISE Pathways Implementation Webinar
June 24, 2014
1:00-2:00 PM EDT
Register

West Regional Meeting
July 15, 2014
Tucson, AZ
Register

Northwest Regional Meeting
July 18, 2014
Rapid City, SD
Register

Careers in Energy Week 2014
October 13-19, 2014

National Forum
November 5, 2014
Arlington, VA

CEWD Annual Summit
November 5-7, 2014
Arlington, VA
Click here to view Summit Sponsorship Opportunities

<Back To Top>