Reporting last winter on a “notable rise” in third-party data breaches in the energy sector, the Security Intelligence blog observed that the trend “sheds light on the need for these energy companies to adopt a proactive approach to securing their networks and customer information.”
Community Electric wasn’t among the companies subject to the breaches, but CEC Information Technology Manager Mitch Simmons already was fully on board with the blog’s recommended approach.
Having labored much of his six years at Community Electric to safeguard the cooperative’s systems and assets against cyberattacks, Simmons had been seeking an educational program through which he could strengthen his cybersecurity skills. With that goal in mind, Simmons last June embarked upon a 20-week cyber security course at ECPI University in Virginia Beach. He completed the coursework and exams in November and emerged with three separate certifications from the Computing Technology Industry Association, a national standards organization.
The class convened two nights per week and, once you add the hours spent studying, the 45-minute commute to and from the ECPI campus, and time required to take the exams during the holiday season, Simmons devoted literally hundreds of hours to learning how to better secure Community Electric against cyberattacks. He earned the certifications – A+, Network+ and Security+ -- in addition to his daily work schedule at Community Electric during that seven-month stretch.
“The biggest benefit to our members and my coworkers,” Simmons says, “is that we have somebody on board working full time and that Community Electric is taking cybersecurity seriously and using the tools that are available. We’ve seen what happens to other businesses; we’ve seen what we’re up against, and we’re trying to be in more of a proactive than a reactive state.”
As part of the ECPI curriculum, Simmons learned how to create several “virtual machines” to enhance the cooperative’s security. One machine (called a honeypot) can bait hackers seeking to infiltrate CEC’s network, isolate them and monitor their behavior and navigation. The other machine (called a sandbox) is a testing platform to ensure that software updates don’t have malware or other coding that would cause problems when installed on CEC’s servers and laptops or otherwise affect phones, substations or meters. The others are for development and testing other devices outside the internal network.
“I have to be forward thinking on this,” Simmons says. “New threats come out every second of every day. Somebody out there is sitting in front of a console, with darkness all around them, writing code trying to find holes and ways into certain places where they can do damage. It’s my job to be better at what I am.”
Community Electric’s president and CEO, Steven A. Harmon, describes Simmons’ accomplishment as “highly impressive.”
“Mitch’s commitment to his job, to our members and to his coworkers is outstanding. It actually borders on the inspiring,” Harmon says. “Mitch will be the first to tell you, cybersecurity is an area of ‘when’ something happens, not ‘if.’ Nonetheless, he has taken it upon himself to place Community Electric and our members in the most secure posture possible, and I know this is a mission to which he commits himself each and every day.”
Simmons says he considers the opportunity to tackle the ECPI coursework a “win-win thing” given the reimbursement that CEC provides for continuing education.
“I’d recommend to anybody wondering what they can do, to prepare themselves like I’m doing. Just take a class; it’s worth it,” he says.
He expresses appreciation that his wife Rosie was his “biggest encourager” to take on the academic challenge and sacrifice some of the quality time the couple spends together.
With his certificates in hand, Simmons plans to contact the outside consultant who guided him through cybersecurity work his first few years at CEC before saying he would stop taking Simmons’ calls because Simmons was learning so quickly and well that he could rely upon his own experience and abilities.
“Admittedly, I was a little disappointed at the time because he was such an outstanding help,” Simmons says. “But I told myself to let it go. I took what he taught me and tried to go with that and find out what I needed to do. Now that I’m finished, I’m going to shoot him an email. I know he’s going to answer me then.”