Air gaps have been ‘shattered’, says new Indian policy on power sector security

India has announced a new security policy for its power sector and specified a grade of isolation it says exceeds that offered by air gaps.

“The much hyped air gap myth between information technology (IT) and operational technology (OT) systems now stands shattered,” the policy states, before going on to offer a slightly odd definition of an air gap.

“The artificial air gap created by deploying firewalls between any IT and OT system can be jumped by any insider or an outsider through social engineering.”

India’s answer is … something that sounds a lot like an actual air gap.

The first item in the new policy is “hard isolation of their OT systems from any internet facing IT system”.

Power sector players – generators, transmission utilities and distributors – have a requirement of “only one of their IT systems with internet facing at any of their sites/locations, if required, which is isolated from all OT zones and kept in a separate room under the security and control of CISO,” referring to the chief information security officer.

The policy also requires any activity on the sole internet-connected system to be done “through an identifiable whitelisted device followed by scanning of both for any vulnerability/malware”. Even that device can only connect to whitelisted IP addresses.

• Infosys and Wipro employees charged with insider trading
• China demands internet companies create governance system for algorithms
• Indian state cuts off internet for millions to stop cheating in exams

If the OT kit at a power player must communicate with the outside world, it should happen over optic fibre and preferably over POWERTEL – a carrier operated by government owned electricity transmission company Power Grid Corporation of India.

One item in the policy to watch is the requirement to use only products deemed to come from “trusted sources”, as that list appears not to have been created before the policy directive was issued. What’s the bet anything made in China isn’t on the list?

The policy also requires all operators of power infrastructure to create an Information Security Division, appoint a CISO to lead it, and ensure compliance with security advisories issued by CERT-IN – including prompt application of patches.

Lifecycle management of all kit is also required, with replacements ordered for any out-of-support products. That new kit must be certified against the Common Criteria standards.

The policy applies to system integrators, equipment manufacturers, and even hardware and software OEMs that serve India’s power supply system. As India has undergone rapid electrification in recent years, under a plan to bring electric power to the entire nation, such suppliers have had huge growth opportunities.

The new policy implies that some of the entities involved in operating the resulting network of generation and transmission infrastructure might not be in the best of shape. Hopefully the document’s debut doesn’t provide an incentive to attackers. ®