21 Apr 2021

Benefits and challenges brought about by a remote approach to NISR implementation

Guest Blog: Billy Cavanagh, Consultant at Atkins as part of our #Cyber2021 week.

Cyber threats to operational technology have adapted over recent years into a very real and dangerous threat to national infrastructure. More and more systems have been connected to the Internet, which has opened up more avenues for attacks, however it has also increased the potential for more holistic security view over what were once heavily siloed systems.

The Network and Information Systems Regulations (NISR) aim to ensure operators of essential services are aware of these new threats facing operational technology (OT) systems and that appropriate measures are in place to detect and manage a security breach. However, with the added complexity of remote working brought about by the COVID-19 pandemic, implementing the necessary changes to not only reduce cyber risk, but increase NISR compliance has been complicated. With increased focus on flexible remote working being present in most future business models, the specific challenges that were addressed, as well as the additional benefits that were realised during the past year will need to be taken into account in order to establish best practice. Most of these benefits and challenges will apply across multiple industries and will need to be carefully managed to help develop successfully resilient cyber enabled sectors.

Virtual engagement and building effective working relationships

Building effective working relationships to enable the successful integration of new procedures and processes is essential. With this engagement switching to be entirely virtual, the ability to understand a business and its employees, and determine effective recommendations in the context of NISR has created additional challenges which need to be monitored:

Managing relationships without screen/email overloading of staff
Reduced pace in understanding the business and its structure
Difficulty in conveying unfamiliar complex regulations and their importance to staff
Slow instant engagement due to limited reading of body language
Diminished cyber security culture and awareness.

Cyber security upskilling without physical hands on training

Having joined a NISR project completely remotely without even stepping foot into the client’s organisation - nor having physically met the Atkins project team - came with its own difficulties. Also, having little prior cyber experience and learning purely through virtual working provided further challenges.

Developing staff understanding of cyber security solely through virtual learning can have considerable drawbacks. Without having hands on appreciation for a product or process, it can be difficult to realise its full impact on a business. To mitigate this, testing and development, as well as virtual training can be undertaken remotely on virtual machines, replicating products or processes that are to be implemented. This increases the upskilling of employees by offering tangible exposure to cyber products, providing a more ingrained and in-depth understanding of cyber security, whilst giving context to the more abstract elements of NISR.

Visualising integration complexities

In addition to an inexperience of physical training, having only remote engagement with a product reduces the ability to understand the intricacies around its capabilities, as well as its integration within the wider business. Limited physical involvement with a product means it’s more difficult to visualise the complexities in how it should be deployed and best integrated with an existing company structure. This can lead to added difficulties when conveying complexities to different areas of an organisation, which will have different perspectives on a project and different personalities to engage with, making it harder to collaborate effectively.

Increased accessibility to personnel

With the majority of non-critical personnel now working remotely, access to key personnel has actually increased since the shift to remote working. Although there have been challenges to overcome with remote engagement, there are benefits which have aided project progression and implementation velocity. These benefits include reduced travel time, more transparency with staff availability and easier access to operational personnel, especially when working with CNI businesses which are usually dispersed over a large geographic area.

Flexible approach with agile remote product deployment

To mitigate risk and to reduce the physical interaction required throughout the course of the pandemic, 3^rd party contractors have been appointed to help deploy products to CNI sites. This comes with additional resourcing and project management challenges, but also provides added value to the project by being more flexible during the deployment phase. This includes:

Reduced physical risk
Minimised travel / expenses
Increases flexibility as physical and virtual implementation of a solution can be separated.

Overall, there have been many learning opportunities whilst developing NISR compliance remotely, which will be applicable to most, if not all, cyber enabled sectors. Businesses in the future will need to be aware of these benefits and challenges when working across a physical and virtual operating model and effectively adjust their project teams to ensure they can level up their business to manage the changing cyber landscape.