Energy board approves $1.8M request to improve Nova Scotia Power’s firewall

The Nova Scotia Power building is pictured in downtown Halifax. (Jonathan MacInnis/CTV Atlantic)

Nova Scotia Power will be getting more than $1.8 million to improve its firewall infrastructure and information technology network.

The Nova Scotia Energy Board approved the request, which NS Power submitted on April 7, according to a news release. The Next Generation Network Security Design project will have an estimated price tag of $1,814,216.

“NS Power seeks to strengthen its security by changing the network configuration and adding a new Virtual Private Network (VPN),” the board’s written decision reads. “The utility states that through an enhanced verification process for users and devices accessing the network, the risk of data breaches and unauthorized access can be reduced.

“This project involves redesigning and reconfiguring the network traffic routing, standardizing the IT firewall design and configuration, overhauling the current firewall infrastructure, adding network access controls and adjusting NS Power’s site-to-site and remote VPN configurations.”

The energy board noted that NS Power said the majority of its network equipment was “end of life” in 2016. The utility created network architecture by adding numerous capabilities and technologies, which made the average age of these assets more than 15 years old.

“The legacy equipment is more than seven years old and is unable to provide ‘the type of security that this new architecture requires,’” the decision reads. “However, NS Power said useful life for these assets is defined by its ability to support new assets, rather than years in use. It added that functionality and ability to maintain security, patching and supportability are also considered. NS Power expects that many assets can continue to be used for lower security needs.”

The energy board said the application was made before NS Power learned it suffered a ransomware attack on March 19. The utility detected the attack on April 25 and launched a response plan. It informed the public of the incident in late May.

Hundreds of thousands of customers could have had their personal information – include birth dates, social insurance numbers and bank account information – stolen.

“While the approved project is related to IT network and firewall infrastructure, the cause of the recent data breach remains under investigation,” the energy board said. “At this time, it is not known whether this specific project would have prevented or mitigated the breach. As per the application, the project has been in progress for more than a year and has an in-service date of September 2025.

“Importantly, the Board’s approval of this project does not preclude it from assessing the adequacy of NS Power’s IT systems as part of the Board’s ongoing investigation into the data breach. The Board is working with cybersecurity experts to conduct a full review of whether NS Power acted prudently before, during, and after the event.”

The energy board said it has engaged MNP to “provider cybersecurity expertise” as part of its investigation.

“The next step is for NS Power to give MNP an initial briefing,” the energy board said in a news release. “Once that briefing has occurred, the Board will determine the rest of the process for the proceeding.”

Last month the Office of the Privacy Commissioner of Canada said it was launching an investigation into the incident to ensure the utility is “effectively addressing the breach and protecting the personal information of its customers.”

For more Nova Scotia news, visit our dedicated provincial page