There seems to be a tendency in the utility sector to hold back when it comes to Cloud. But cloud solutions are full of advantages, even for companies in the utility sector, as long as they support business processes and focus on operational security.
Companies with infrastructure critical to society as their core service often tend to be cautious when it comes to cloud solutions. And the reason is often quite simple:
- Companies in the utility sector are fundamentally driven by strong citizenship and the necessary respect for the societal consequences which can follow a breakdown of their systems. Therefore, these companies are driven by an operational approach, which naturally dominates. And this approach often results in a cautiousness towards internet-based cloud solutions, says Esben Kaufmann Associate Vice President in NNIT.
This is especially the case when it comes to operational technology (OT) systems.
- IT departments are often more prepared to go with cloud, but in their case, the risk factor of a system's inaccessibility is often not as critical from a societal perspective. For example, if the pay system breaks down on a given day, it is still critical for the individual company, but it does not affect the outside world in the same way as when the power goes out. Therefore, we find that the dominant approach in the OT departments is that operating systems are too critical to move to the cloud - and cloud solutions are therefore rarely on the radar.
Cloud or on-premise depends on how critical the system is
And that is a shame, if you ask Esben Kaufmann. According to him, cloud solutions in the utility sector do not have to be limited to IT - some OT systems can also be moved to the cloud. What is crucial is that the decision is made as part of a tightly controlled change management process and with a focus on operational security.
- What are the safety criteria for the operation? The answer to that question should be offset when assessing the cloud readiness of an OT system. Both accessibility and system control are crucial elements, so you need to look at recovery time objective (RTO) first and foremost.
- A thorough impact assessment is a necessary first step. It is about figuring out how much downtime a system can stand. Only once you know your RTO precisely can you assess whether or not a system can be moved from on-premise to cloud.
For the same reason, it is primarily supportive OT systems – which typically have a longer RTO – that are suited for the cloud:
- For example, this could be supportive alarm systems. These are systems that basically have to work if something goes wrong. At best, however, they are never in use. They are not critical for the day-to-day operation, but they support systems that are, explains Esben Kaufmann.
The cloud releases resources – so you can focus on your core business
By moving supportive OT systems to the cloud, utilities can gain some of the cloud benefits that other sectors and industries have been enjoying for a long time.
- With SaaS you get a solution where the SaaS supplier takes care of the development, maintenance and support of the system. This saves you resources on maintenance, migration and testing, and those resources can then be released for more value-adding activities, says Esben Kaufmann and continues:
- You move costs from CAPEX to OPEX because you no longer have to invest in physical hardware or servers – instead, you just pay for usage. What's more, with SaaS solutions a large part of the cost and responsibility for the security of the solution rests with the cloud provider, which distributes the costs to customers.
Read the article about 7 good reasons for moving to the cloud
OT people still doubt cloud security
Although there has been a greater focus on the opportunities and benefits of cloud-based solutions targeting the utility sector, Esben Kaufmann feels that the industry is still characterized by a certain amount of cloud skepticism:
- We have seen a number of high-exposure cases where large amounts of data have been leaked from the cloud, which has given all cloud solutions a slightly blighted reputation. It is, however, unfair. The problem in these cases has typically not been the solution, but that it was not properly configured by the client. Cloud systems today are typically very user-friendly and relatively easy to configure, but if it is not done with safety awareness, they can be left wide open.
Conversely, the cloud often improves the safety of the individual business – as long as it is properly configured in terms of security.
- The cloud architecture is basically very secure. Typically, the weakness lies in the configuration that the clients must perform themselves, but help is available. Years ago, when the first companies started pushing operating systems into the cloud, they also had reservations and concerns, especially about security. Today, we know that for most people well-configured cloud solutions are more secure than on-premise solutions. For utility companies, this is more of a matter of thorough processing, primarily with a focus on ensuring operational availability in connection with cloud migration, concludes Esben Kaufmann.
At NNIT, we have cloud experts specializing in the utility sector who can help with both impact analysis, consulting and implementation of cloud solutions designed for the utility sector. Read more here
