03-25-2019 BPU RPT 09 - Laserfiche WebLink

Home

W A T E R E N E R G Y T I F F id& P U B L I C U T I L I T I E S BOARD OF PUBLIC UTILITIES RIVERSIDE PUBLIC UTILITIES Board Memorandum DATE: MARCH 25, 2019 ITEM NO: 9 SUBJECT: PURCHASE ORDER WITH INSIGHT PUBLIC SECTOR INC. OF IRVINE, CALIFORNIA FOR THE SUPPLY OF EQUIPMENT AND SOFTWARE FOR $179,772 AND APPROVE WORK ORDER NO. 1914017 IN THE AMOUNT OF $220,024 FOR THE CYBER SECURITY UPGRADE PROJECT AT THE RIVERSIDE ENERGY RESOURCE CENTER AND SPRINGS GENERATING STATION ISSUES: Approve the issuance of a purchase order with Insight Public Sector of Irvine, California for the supply of equipment and software in the amount of $179,772 and approve Work Order No. 1914017 for $220,024 for the Cyber Security Upgrade Project at the Riverside Energy Resource Center and Springs Generating Station. RECOMMENDATIONS: That the Board of Public Utilities: 1. Approve the issuance of a purchase order with Insight Public Sector of Irvine, California in the amount of $179,772 pursuant to Purchasing Resolution 23256, Section 702(e); and 2. Approve Work Order No. 1914017 in the amount of $220,024 for the Cyber Security Upgrade Project at the Riverside Energy Resource Center and Springs Generating Station. BACKGROUND: In March 2016, Securicon, LLC (Securicon) conducted a comprehensive information technology (IT) security assessment on the Supervisory Control and Data Acquisition (SCADA) networks at the Riverside Energy Resource Center (RERC) and the Springs Generating Station (Springs). The assessment consisted of internal and external penetration tests that evaluated each power plant's vulnerability to cyber threats and unauthorized users. Both RERC and Springs achieved excellent results on the external penetration tests. Securicon was unable to infiltrate the existing security systems and firewalls at each facility. However, the internal penetration tests resulted in five network security recommendations that solidify the SCADA infrastructure and better align each facility with the industry's best practices. One of the recommendations is to replace the SCADA devices that were installed since the power plants were first constructed (over 10 years ago) and update the existing network to current security standards. The newer devices allow for a configuration that provides higher security against unauthorized users to the SCADA networks.