Nextpower Inc. · NASDAQ:NXT
Nextpower — NEXTracker — Solarplaza Cybersecurity Webinar: Understanding and mitigating Cybersecurity risks in the (February 2018)
38 slides from Nextpower's conference presentation, February 2018
Slide 1: Welcome to the webinar!
Welcome to the webinar! We will start within a few minutes
Slide 2: Solar Asset Management
SOLAR ASSET \ ~~ | SWSWRS RRA
Slide 3: Agenda
Agenda • Introduction Solarplaza • Presentations Threat assessment - Tom Tansy | SunSpec Alliance Cyber Security & Solar – A consultant’s view - John Franzino | GridSME Building Security into Product Design - Allan Daly | NEXTracker • Q&A • End of the webinar
Slide 4: Q&A time
Q&A time Kostis Tzanakakis • Email / skype: [email protected] • Phone: +31 10 302 7903 Website: www.solarassetmanagement.us
Slide 5: About Solarplaza
About Solarplaza "To positively impact the world by accelerating the sustainable energy transition" • Established in 2004 • 100+ events organized • In 30+ countries worldwide • Network of 60.000+ solar PV professionals
Slide 6: Solar Asset Management North America
Solar Asset Management North America 13-14 March 2018 /// San Francisco The leading conference focused on the operational phase of solar plants and portfolios • THE must-attend event fully dedicated to the operational phase of PV assets • 500+ attendees, representing the value chain from service pro
Slide 7: Attendees 2018
(Ss) SUNSPEC SOLARPLAZA webinar aces Distributed Energy ENERG =< TECH] NUL. > Héliolytics Munich RE 2 (@Solar-Log SoticHAMBA =—SOltage TESLA Siyte = Oclenera «= CMI eC 2 ENVISION é@on INGORE aa Qrinfiswift ober GO caneses @Nawtivessior Bobvius Me ricco = SSPLEXUS TRAVELERST §=—- UEC y vivint.Solar —
Slide 8: Sponsors
SOLARPLAZA webinar Understanding and mitigating Cybersecurity risks in the solar industry Diamond Sponsors o POWERHUB poe Sponsors SOLAR ASSET MANAGEMENT SOLAR ASSET MANAGEMENT Gold Sponsors ' 6 Se ie ee cf QO ane Seenr, | Dinfiswift _— O ' Locus .a0s 2 ENVISION ——S MMoiotytics POWER eos aN SEL En.
Slide 9: Special Webinar Promotional Discount
Solar Asset Management North America Special Webinar Promotional Discount First 10 registrants to use the code WEBINAR20 are eligible for a 10% discount on the registration fee. https://solarassetmanagement.us/register-now/
Slide 10: Practical notes
Practical notes • Technical issues? Use chatbox • The presentation slides will be available afterwards
Slide 11: Tom Tansy
Tom Tansy • CHAIRMAN - SUNSPEC ALLIANCE • In SunSpec Alliance he leads the distributed energy industry's efforts to establish data and communication standards that enable seamless integration of solar PV and storage into the Smart Grid. • The SunSpec Alliance has more than 100 stakeholders across th
Slide 12: John Franzino
John Franzino • DIRECTOR OF GRID SECURITY – GRIDSME • John and the cyber security team assist clients with all aspects of Critical Infrastructure Protection (CIP), as well as general cybersecurity support outside the scope of CIP. • John manages both day-to-day operations and long-term projects, whi
Slide 13: Allan Daly
Allan Daly • VP SOFTWARE ENGINEERING – NEXTRACKER • Allan Daly leads the software team and is lead product manager for the Company's TrueCapture smart software control system. • In this capacity, he leads a team of 10 software engineers to design and develop intelligent, connected industrial softwar
Slide 14: Threat assessment: what should asset managers be thinking about?
Threat assessment: what should asset managers be thinking about? Tom Tansy SunSpec Alliance www.sunspec.org
Slide 15: Security required for all PV systems
Security required for all PV systems • State-level mandates specify secure networks for all systems – C&I and Residential – California (Rule 21) and Hawaii (Rule 14H) effective now • National mandate to securely network ALL DER systems – Specified in IEEE 1547-2018 • Considerations are different – S
Slide 16: Why worry about small systems?
Why worry about small systems? http://www.forbes.com/sites/thomasbrewster/2016/08/01/1000- http://www.bbc.com/news/amp/technology-40861976 solar-panels-tigo-vulnerable-hackers
Slide 17: Considerations for asset managers
Considerations for asset managers • Risk management: proportional responses • Regulatory: rules that apply differ by system size • Equipment: products that work • Finance: budgets that scale • Personnel: training & record keeping
Slide 18: Discussion
SOLARPLAZA webinar Understanding and mitigating Cybersecurity risks in the solar industry Discussion SUNSPEC ars —ALLIANCE—~ 8% GridSIVE NE? racker SUBJECT MATTER EXPERTS A Flex Company SOLAR ASSET SUNSPEC © MANAGEMENT = NORTH AMERICA
Slide 19: Upcoming Events
Upcoming Events Solar Asset Management North America 13-14 March 2018 San Francisco www.solarassetmanagement.us Solar Asset Management Asia 24-25 May 2018 Tokyo, Japan www.solarassetmanagement.asia
Slide 20: Cyber Security and Solar PV
Cyber Security and Solar PV Solar Asset Management – North America January 31, 2018 John Franzino Director of GridSecurity
Slide 21: Observing the Fact of the Matter
Observing the Fact of the Matter ICS-CERT 2016 Annual Report Number of Vulnerabilities 2 2/5/2018
Slide 22: Observing You're Not Too Small
Observing You’re Not Too Small 3 2/5/2018
Slide 23: Observing You're Not Too Small
Observing You’re Not Too Small 4 2/5/2018
Slide 24: Observing Threats in Real-Time
Observing Threats in Real-Time 1 min 5 2/5/2018
Slide 25: Orienting Business Constraints & Opportunities
Orienting Business Constraints & Opportunities 6 2/5/2018
Slide 26: Deciding Impacts
Deciding Impacts Annual Loss Expectancy = [Likelihood, expressed as "# of incidents per year"] * [Impact, expressed as "$ loss per incident"] 7 2/5/2018
Slide 27: Deciding Budgets
Deciding Budgets PPA $40/MWh Nameplate 100 MW Capacity Factor 25% 4 hours = $12,000 8 hours = $24,000 2 days = $48,000 7 days = $168,000 8 2/5/2018
Slide 28: Guiding Decisions
Guiding Decisions NERC CIP CIS Top 20 CSC NIST SP 800-53 9 2/5/2018
Slide 29: Compliance Pause
Compliance Pause NERC CIP is meant to be the floor not the ceiling 10 2/5/2018
Slide 30: Cyber Security Framework & Solutions for Utility-Scale and C&I Systems
Cyber Security Framework & Solutions for Utility-Scale and Commercial/Industrial Systems Allan Daly, VP Software, January 31, 2018 Copyright ©2017 NEXTracker
Slide 31: Cyber Security: Little Things
CYBER SECURITY Careful planning and implementation of many “little things” make Secure Connectivity at Scale possible and achievable. “It's the little details that are vital. Little things make big things happen.” ᅳ John Wooden “ It has long been an axiom of mine that the little things are infinitel
Slide 32: Secure Data Center Remote
SECURE BI-DIRECTIONAL DATA PIPELINE SECURE DATA CENTER REMOTE SERVICES SECURE COMPONENTS AND SYSTEMS Proprietary and Confidential ©2017 3
Slide 33: Our World @ NEXTracker
OUR WORLD @ NEXTRACKER KEY METRICS & GOALS • 11 GW trackers delivered & in fulfillment • 175 MW weekly manufacturing capacity N. America: • #1 market share, 2 years > 7.5 GW • Parent company Flex, $24Bn revenue • Connect to, and acquire data from, every India component and every & MENA system every
Slide 34: Top 7 Questions Owner/Operators Ask
TOP 7 QUESTIONS OWNER/OPERATORS ASK: 1 How do you handle security with your Zigbee wireless network? 2 How do you protect power plants from hackers if there is remote access? 3 What protocols do your equipment use and what protections does your equipment have? What data do you use? 4 What platforms
Slide 35: Case Study: C&I (DG) Cyber Security
CASE STUDY: C&I (DG) CYBER SECURITY Remote NOC REMOTE NOC security measures (NETWORK • access control OPERATIONS • incident response CENTER) • patch management • virus management • access logging Bi-Directional Data Connector security measures • encryption Firewall • Authentication • authorization N
Slide 36: Case Study: Utility-Scale Cyber Security
CASE STUDY: UTILITY-SCALE CYBER SECURITY Data Center Data center security measures DATA CENTER cyber security boundary • access control • incident response plan • data management REMOTE NOC • virus management (NETWORK • access logging OPERATIONS Remote NOC CENTER) security measures Firewall • access
Slide 37: Typical Security Platform Recurring Tasks
TYPICAL SECURITY PLATFORM RECURRING TASKS Activity Frequency Activity Frequency Physical Security Plan Audit Annually System Recovery Plan Audit Annually Cyber Awareness Training Annually Change Management Plan Audit Annually Electronic Security Perimeter (ESP) Plan Audit Annually Configuration Moni
Slide 38: Thank You
CONTACT: Allan Daly VP Software Engineering Email: [email protected] THANK YOU Copyright ©2017 NEXTracker, Proprietary and Confidential