Technical notes.

The instinct in most organisations is to treat a storage site as another set of assets to bring under the existing security programme: inventory them, segment them, patch them, monitor them. All of that is worth doing and none of it answers the question that actually matters.

In an IT system, the worst outcome of a compromise is usually about data — it is exfiltrated, encrypted, or altered. In a storage system the worst outcome is a physical state: a cell outside its safe operating window, a contactor in the wrong position, a converter pushing power in a direction the grid connection was not expecting. The compromise is the means; the physical state is the damage.

That difference changes what an assessment must produce. It is not enough to enumerate reachable services. You have to be able to say, for each reachable interface, which physical behaviours it can influence — and then ask what independent mechanism refuses an instruction that is validly formed but operationally wrong.

The word independent is doing the heavy lifting. Most systems have protection. The question is whether that protection would still function if the thing that issued the bad instruction were fully controlled by someone else. Where protection logic runs on the same controller, or trusts the same telemetry, or is configured through the same interface, defence in depth is thinner than the architecture diagram suggests.

This is also why security recommendations for storage sites fail more often than they do in IT. A recommendation that would trip a site, void an equipment warranty or breach a grid code will not be implemented, no matter how correct it is about the risk. Assessments that do not account for that produce documents rather than change.

The surface is larger than the site. A modern storage asset is operated remotely because that is the only economical way to run a distributed fleet, which means the maintenance and management channels are not an edge case — they are the primary architecture.

Working outward from the cells, the paths that consistently deserve attention are these. Vendor remote access, because it is designed to reach the controllers directly and often predates any formal access-management process. Firmware update channels, because they are a sanctioned remote-write path into a safety-relevant device, and their security depends on signature verification actually happening on the device rather than merely being available. Cloud and fleet platforms, because a compromise there is multi-site by construction. Unauthenticated industrial protocols, several of which were designed for physically trusted serial links and inherited into routed networks without gaining authentication on the way. And gateways, which frequently constitute the real segmentation boundary while being the least-maintained device on the site.

What ties these together is that each is a legitimate operational capability. None is a misconfiguration to be closed. The work is not removing them but bounding them: who, from where, for how long, able to reach what, and visible to whom.