Protect - Revision history

EPhann2: /* Identity and Access Management */

2026-09-21T03:35:32Z

Identity and Access Management

← Older revision		Revision as of 03:35, 21 September 2026
Line 113:		Line 113:
	Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.		Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.

	[[File:IAM.png\|~~600px~~\|right\|IAM Capabilities, per EPRI Identity and Access Management Guideline]]		[[File:IAM.png\|500px\|right\|IAM Capabilities, per EPRI Identity and Access Management Guideline]]
	'''IAM Current Practices and Challenges''' in energy power generation:		'''IAM Current Practices and Challenges''' in energy power generation:
	*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.		*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.

EPhann2: /* Identity and Access Management */

2026-09-21T03:35:01Z

Identity and Access Management

← Older revision		Revision as of 03:35, 21 September 2026
Line 113:		Line 113:
	Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.		Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.

	[[File:IAM.png\|~~800px\|thumb~~\|right\|IAM Capabilities, per EPRI Identity and Access Management Guideline]]		[[File:IAM.png\|600px\|right\|IAM Capabilities, per EPRI Identity and Access Management Guideline]]
	'''IAM Current Practices and Challenges''' in energy power generation:		'''IAM Current Practices and Challenges''' in energy power generation:
	*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.		*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.

EPhann2: /* Identity and Access Management */

2026-09-21T03:34:21Z

Identity and Access Management

← Older revision		Revision as of 03:34, 21 September 2026
Line 113:		Line 113:
	Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.		Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.

	[[File:IAM.png\|800px\|thumb\|right\|IAM Capabilities, per EPRI Identity and Access ~~Managment~~ Guideline]]		[[File:IAM.png\|800px\|thumb\|right\|IAM Capabilities, per EPRI Identity and Access Management Guideline]]
	'''IAM Current Practices and Challenges''' in energy power generation:		'''IAM Current Practices and Challenges''' in energy power generation:
	*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.		*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.

EPhann2: /* Identity and Access Management */

2026-09-21T03:34:05Z

Identity and Access Management

← Older revision		Revision as of 03:34, 21 September 2026
Line 113:		Line 113:
	Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.		Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.

	[[File:IAM.png\|~~600px~~\|thumb\|right\|IAM Capabilities, per EPRI Identity and Access Managment Guideline]]		[[File:IAM.png\|800px\|thumb\|right\|IAM Capabilities, per EPRI Identity and Access Managment Guideline]]
	'''IAM Current Practices and Challenges''' in energy power generation:		'''IAM Current Practices and Challenges''' in energy power generation:
	*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.		*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.

EPhann2: /* Identity and Access Management */

2026-09-21T03:33:50Z

Identity and Access Management

← Older revision		Revision as of 03:33, 21 September 2026
Line 113:		Line 113:
	Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.		Identity and access management (IAM or IdAM) cyber security controls for authentication, authorization, and auditing only allow access when and where required to perform required operations. This includes verifying that the user is who they say they are. Identity and access management restricts unnecessary access and provides proper authentication and authorization methods for operation and maintenance.

	[[File:IAM.png\|~~400px~~\|thumb\|right\|IAM Capabilities, per EPRI Identity and Access Managment Guideline]]		[[File:IAM.png\|600px\|thumb\|right\|IAM Capabilities, per EPRI Identity and Access Managment Guideline]]
	'''IAM Current Practices and Challenges''' in energy power generation:		'''IAM Current Practices and Challenges''' in energy power generation:
	*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.		*Control systems utilize traditional methods such as Active Directory and local passwords. Multifactor authentication is implemented in some cases through IT/OT use cases, such as remote access through IT infrastructure.

EPhann2: /* Hardening */

2026-09-21T03:33:35Z

Hardening

← Older revision		Revision as of 03:33, 21 September 2026
Line 50:		Line 50:
	Hardening is the process of securing systems and devices by reducing their attack surface and minimizing vulnerabilities. It involves configuring OT components with security best practices like limiting unnecessary access, disabling the ports and services not in use, and implementing strong authentication controls and encryption.		Hardening is the process of securing systems and devices by reducing their attack surface and minimizing vulnerabilities. It involves configuring OT components with security best practices like limiting unnecessary access, disabling the ports and services not in use, and implementing strong authentication controls and encryption.

	[[File:Hardening.png\|600px\|right~~\|Hardening Implementation~~]]		[[File:Hardening.png\|600px\|right]]

	'''Challenges''' with hardening in power generation facilities include:		'''Challenges''' with hardening in power generation facilities include:

EPhann2: /* Hardening */

2026-09-21T03:30:05Z

Hardening

← Older revision		Revision as of 03:30, 21 September 2026
Line 49:		Line 49:
	== Hardening ==		== Hardening ==
	Hardening is the process of securing systems and devices by reducing their attack surface and minimizing vulnerabilities. It involves configuring OT components with security best practices like limiting unnecessary access, disabling the ports and services not in use, and implementing strong authentication controls and encryption.		Hardening is the process of securing systems and devices by reducing their attack surface and minimizing vulnerabilities. It involves configuring OT components with security best practices like limiting unnecessary access, disabling the ports and services not in use, and implementing strong authentication controls and encryption.

			[[File:Hardening.png\|600px\|right\|Hardening Implementation]]

	'''Challenges''' with hardening in power generation facilities include:		'''Challenges''' with hardening in power generation facilities include:
Line 55:		Line 57:
	*Customized devices are not designed to handle traditional security configurations and can be too resource-intensive		*Customized devices are not designed to handle traditional security configurations and can be too resource-intensive
	*Lightweight and critical controls should be implemented first.		*Lightweight and critical controls should be implemented first.

	~~[[File:Hardening.png\|600px\|right\|Hardening Implementation]]~~

	'''Current hardening key practices''' include vendor hardening, company-specific baselines, and asset configuration management:		'''Current hardening key practices''' include vendor hardening, company-specific baselines, and asset configuration management:

EPhann2: /* Hardening */

2026-09-21T03:29:48Z

Hardening

← Older revision		Revision as of 03:29, 21 September 2026
Line 55:		Line 55:
	*Customized devices are not designed to handle traditional security configurations and can be too resource-intensive		*Customized devices are not designed to handle traditional security configurations and can be too resource-intensive
	*Lightweight and critical controls should be implemented first.		*Lightweight and critical controls should be implemented first.

			[[File:Hardening.png\|600px\|right\|Hardening Implementation]]

	'''Current hardening key practices''' include vendor hardening, company-specific baselines, and asset configuration management:		'''Current hardening key practices''' include vendor hardening, company-specific baselines, and asset configuration management:
Line 60:		Line 62:
	*Address regulatory requirements, industry standards, and company-specific baselines.		*Address regulatory requirements, industry standards, and company-specific baselines.
	*Documentation asset configurations in conjunction with hardening.		*Documentation asset configurations in conjunction with hardening.

	~~[[File:Hardening.png\|600px\|right\|Hardening Implementation]]~~

	'''Relevant EPRI Resources'''		'''Relevant EPRI Resources'''

EPhann2: /* Hardening */

2026-09-21T03:29:09Z

Hardening

← Older revision		Revision as of 03:29, 21 September 2026
Line 61:		Line 61:
	*Documentation asset configurations in conjunction with hardening.		*Documentation asset configurations in conjunction with hardening.

	[[File:Hardening.png\|600px~~\|thumb~~\|right\|Hardening Implementation]]		[[File:Hardening.png\|600px\|right\|Hardening Implementation]]

	'''Relevant EPRI Resources'''		'''Relevant EPRI Resources'''

EPhann2: /* Hardening */

2026-09-21T03:28:08Z

Hardening

← Older revision		Revision as of 03:28, 21 September 2026
Line 61:		Line 61:
	*Documentation asset configurations in conjunction with hardening.		*Documentation asset configurations in conjunction with hardening.

	[[File:Hardening.png\|~~200px~~\|thumb\|right\|Hardening ~~Implplementation~~]]		[[File:Hardening.png\|600px\|thumb\|right\|Hardening Implementation]]

	'''Relevant EPRI Resources'''		'''Relevant EPRI Resources'''