Xcel Energy Wins the Inaugural F5 Customer Innovation Award

It’s always exciting to learn how our customers are using F5 technologies to solve real-world problems in pioneering ways, and I’m thrilled that we are now recognizing and celebrating the ingenuity and resourcefulness of our customers with our first-ever Customer Innovation Award. This year’s award, which we’re announcing this week at AppWorld, goes to Xcel Energy, an electric utility and natural gas delivery company based in Minneapolis, Minnesota, that serves more than 3.7 million electric customers and 2.1 million natural gas customers across parts of eight U.S. states. 

The F5 Customer Innovation Award celebrates exceptional customers that leverage the F5 portfolio to transform their organization and push the boundaries of what’s possible. We’re recognizing Xcel Energy for the company’s success in using F5 products and services in industry-leading ways. In my opinion, Xcel is a wonderful example of how enterprising customers can extend F5 functionality to address the needs of their organizations and take the lead in their industries. 

F5 will continue to present the Customer Innovation Award annually to recognize customers that demonstrate groundbreaking use of F5 products and services, showcasing measurable impact, creative problem-solving, and forward-thinking solutions. 

I’m honored that Xcel Energy has been an F5 customer for almost a decade. The company employs F5 BIG-IP products for application hosting, security, and remote access. More recently, it has deployed F5 Distributed Cloud Services to connect and protect modern apps across multiple environments. 

Our products have helped Xcel Energy strengthen security across a dispersed utility environment at a time when the energy industry is undergoing a period of disruption. Colin Barr, a leader at Xcel Energy, explained it like this: “On the one hand, utilities maintain large legacy operational technology, or OT, systems, including the power grid and energy services, which have traditionally been completely isolated from external networks. However, maintaining the isolation of these private systems is increasingly challenging as the number of public-facing applications such as smart meters grows, and as modern IT infrastructures increasingly rely on the public cloud. Privatization, and mitigation to over-exposed attack surfaces is a critical strategy utilities are acting on.  In addition, regulatory and audit compliance now often takes on a cloud-first reporting approach.” 

Xcel Energy has achieved particular success with F5 Distributed Cloud Web App Scanning, a service that dynamically and continuously scans external attack surfaces to uncover exposed web apps and APIs, employing automated penetration testing to simplify discovery of application vulnerabilities.

Colin told me Xcel uses Distributed Cloud Web App Scanning to monitor threats to the front end of public-facing applications to ensure these threats don’t compromise the isolation of its OT environments. “Some of the known pain-point areas do not have the sufficient levels of isolation or segmentation,” he said. “These are primarily applications and digital assets in the security borders where OT and IT integrate, which include the field area network, customer home applications, energy management systems, distribution management systems, outage correlation services, and the front end of accounts and billing.” Xcel uses the information from the web app scan to inform security teams of additional controls they may need to apply downstream to non-public-facing applications.    

“We leverage risk towards solutions that inherit dependencies in both ecosystems, and based on their exposure and attack surface, we trickle down protection mechanisms in firewalls, application patching, and hardening of equipment.” Xcel gains a better understanding of its front end exposure and the domino effect of ensuring these public exposures are also mitigated in high watermark environments. “Distributed Cloud Web App Scanning helps create and ensure a baseline of risk tolerance and correct for threats in areas beyond the public Internet,” he said.