A security strategy that integrates cyber and physical security operations is considered best practice to protect against increasing cyberattacks and cybercriminal acts that are a challenge for utilities to mitigate, says BT Africa IT Security Sales head Alessandro Postiglioni.

Physical and virtual assets are interdependent, making a coordinated security approach and bringing information technology (IT) security together under one management umbrella important, he explains.

Physical security can be handled through field-based staff, a control centre and an access-control team, while cyberdefence operations using a security operations centre and a computer emergency response team act as the frontline against IT threats and abuse of the network.

Meanwhile, specialist cyberoperations can act as a nerve centre for proactive network defence, monitoring incoming threats and devising strategies to stop information assets from being compromised, he adds.

Once an integrated security strategy is in place, the utility should have a better understanding of potential imminent threats and any future threats. “Attention should then be turned to protecting each layer of the network and every end point,” says Postiglioni.

When a security strategy is mapped, the scope must cover a wide range of devices and access points, owing to the proliferation of connected devices.

This adds layers of complexity to protecting the business network for any business offering cloud- and Internet of Things- based services to clients, but has also made end point security critical, he adds.

“A proactive approach to end point security includes the network, applications, critical data and identity security, which the utility can then extend across all end points and business sites,” advises Postiglioni.

End point security must be fully integrated into an overall cloud computing and security strategy. There must be a common security goal for the business, as this reduces the potential risk of dislocation in security processes, which can also create unnecessary vulnerabilities.

“The security strategy must ‘bring together’ the beginning, middle and end point under one central end point-protection infrastructure and policy-enforcement mechanism that does not hamper users or impact on the performance of their machines.”

As people and things become increasingly connected, streamlined, centralised and intuitive, security measures are required. Utilities should undertake a full vulnerability analysis of their current controls and best practices, and determine whether these stand up against the threats they face.

“Controls can be refined to plug potential gaps only by identifying and understanding these gaps. Combined with the capabilities that . . . innovative technologies boast, including cloud computing and IoT, a utility will be well placed to build more effective prevention capabilities across its business network and growing number of end points.

This integrated view and management of physical and cybersecurity enables a utility to maintain a sustainable risk position against the evolving threat landscape in the digital world, concludes Postiglioni.