• United States



by CSO Contributor

Reporting, Regulating and Merging

Feb 01, 20053 mins
CSO and CISOData and Information Security

George Miserendino is the owner and president of security consultancy Triton Security Solutions, which specializes in infrastructure protection strategies for the electricity, gas and water industries. He also has 30 years of experience in security services management. CSO contacted him to tap his extensive industry expertise on matters of compliance, consolidation and critical infrastructure.

Where do you think the infrastructures are in terms of using “intelligent video” for protection of the buffer zones?

The BZPP (Buffer Zone Protection Plan) is an initiative of the Department of Homeland Security that specifies the types of equipment to be used near identified “critical assets.” I envision that, during 2005, this DHS project may receive considerable attention from the various critical infrastructures where it will be applied to assist in countersurveillance and incident deterrence initiatives.

Where do you think corporate security should report in a utility? And what should be the relationship between physical security and data security?

Physical and data security are partnering on a more frequent basis. The NERC Cyber Security Standards will help facilitate a clearer working relationship. Reporting relationships in the utility industry vary broadly, with security functions being located in shared services, administrative services, legal departments, human resources and (in a few rare instances) operating line organizations. The reporting location is not as important as the proactive support of corporate senior management, specifically the CEO, COO, CIO and so on.

How well is the industry responding to the legislation? Are companies making their deadlines and actively complying?

Recent surveys indicate that both the electric and gas sectors are meeting FERC, Coast Guard, TSA and NERC security initiatives. Companies are modifying policies and procedures, conducting tabletop exercises, and applying technologies (card access, CCTV, intrusion detection systems) at facilities determined to be “critical” to the company.

What impact is all the consolidation of energy companies through mergers having on security?

Mergers have slowed progress in some areas due to the new senior management team coming in and identifying what their priorities will be and how they will achieve them. In most cases, security projects and initiatives have been placed in abeyance until strategic plans are finalized. However, in all instances where government regulatory initiatives have been identified, companies have responded favorably to meet the new standards.

Are we safer because of this regulation, or would we have gotten there without it?

Without a doubt, we are significantly safer today than we were prior to 9/11 as a result of a number of regulatory initiatives. These include bulk electric power transmission, dams, facilities on navigable waterways and so on.

What should companies be doing that they are not? What should have been required that was not?

Companies should continue to validate their processes to identify critical facilities, assets and systems. In this regard, a better understanding of these systems and their interdependencies with other infrastructures should be further researched and understood.

You were at this before the phrase “critical infrastructure” was coined. What have been the most significant changes you’ve seen that have improved security?

The development of companywide “security councils” to address and validate security program initiatives. Generally, these councils are made up of senior management representatives who are subject-matter experts, representing their respective organizations. These councils have been successful in raising security awareness issues and opportunities across many corporate business functions, thereby facilitating progress.