“These intrusions are happening hundreds of thousands of times a day.”
Rick Perry
(US Secretary of Energy)
The cyber landscape for the energy and utility industry is getting increasingly complex. It’s not just because of the escalating geopolitical and cyber uncertainty post Russia’s invasion of Ukraine.
It is mainly because this industry is at the forefront of efforts to create a cleaner, dependable, affordable, and sustainable energy future. It also faces complex challenges with new technologies and business venture exploration.
Therefore, allowing for more complex connections to the energy infrastructure while navigating an ever-changing regulatory landscape
The Utility sector is one of the top three that report cyberattacks. Only two other sectors have reported more cybersecurity incidents – critical manufacturing and communications.
Growing Cyber Risk in Energy & Utilities Sector
The interesting fact is security risks in this sector do not arise due to a lack of awareness. This is why despite being frequently targeted, the energy and utility sector is always the first to respond with mandatory precautions and controls. 85% of the energy and utility companies know that a cyberattack in their industry is likely to cause
- Operational shutdowns
- Damage energy assets
- Harm critical infrastructure
And these are the damages that the majority highly agree to. The undermined and under-discussed costs of cyber attacks in the energy sector include environmental harm and loss of life.
Nevertheless, despite being the best considering defense and retaliation, the energy and utility sectors face evolved threats that reach into supply chains and industrial control systems. Therefore, greater security, better awareness, and more effort are required to manage risk.
A Sneak Peek Into Infamous Cyber Attacks In Energy and Utilities
The energy and utility sector has always been the prime target for cyberattacks in the United States, Europe, Australia, and Japan. In Australia, this sector has been identified with the highest number of reported cybersecurity incidents/ near-incidents. Let’s quickly go through the top five cyber attacks in the energy and utilities industry in the last five years:
Colonial Pipeline Attack
One of the recent cyberattacks that received the most attention was the Colonial Pipeline attack. The largest fuel pipeline in the US was the target of a ransomware attack and forfeited a $4.4 million ransom to the gang responsible.
The initiator of this attack was a compromised password of an employee. The business might not have used multi-factor authentication, a fundamental cybersecurity tool, to defend itself against online hackers.
Delta-Montrose Electric Association (DMEA)
Due to malicious ransomware that deleted 25 years’ worth of historical data, the Colorado energy company was forced to shut down 90% of its internal controls in January 2022. The energy provider was open and honest with its customers about the possibility of receiving multiple energy bills.
Saudi Aramco Petrochemicals Attack
In 2017, hackers targeted the safety system in Saudi Aramco’s petrochemical plants, making the company a target of cyberattacks. Experts think a mishap could have happened despite the plant shutdown.
A plant official reportedly claimed that the attack was intended to send a political message in addition to shutting down the plant and erasing data. Experts could link the attack to a laboratory run by the Russian government.
European Network of Transmission System Operators for Electricity (ENTSO-E)
The most recent cyberattack victim in the power sector is the European Network of Transmission System Operators for Electricity (ENTSO-E).
On March 9, 2020, ENTSO-E, an organization representing 42 transmission system operators in Europe across 35 countries, announced that it had recently “found evidence of a successful cyber intrusion into its office network” and was putting in place backup plans to fend off additional attacks.
Amsterdam-Rotterdam-Antwerp (ARA)
Just a few months before the ARA cyberattack in February 2022, a minor but comparable attack on two German companies disrupted the gasoline supply in northern Germany.
The attack’s cause may not have been clear, but its effects mainly included hindering administrative tasks and interfering with the loading and unloading cargo carrying refined products. There might be additional, significant economic cascading effects in every European nation.
Security Awareness for the Energy & Utilities Sector
Check our industry page to find out how organizations in the Energy & Utilities sector face cyber risk emerging from their IT, OT, and supply chain infrastructures with Security Awareness
Energy And Utility Sector Is Only As Strong As Its Weakest Link
The invasion of Ukraine by Russia has only increased people’s concern and awareness of cybersecurity threats. Six out of ten C-suite respondents agree that today’s attacks are more likely to succeed than ever.
Considering all the challenges that the energy and utility sector is facing, it’s essential to consider:
Smart Allocation Of Budgets
Invest in OT and IT instead of energy-transition programs and digitalization (especially when you’re not ready for the vulnerabilities that come with these). Do not lose focus on IT and OT investments, as they are the core capabilities of the energy and utility sector.
Risk Assessment
Determine the vulnerabilities and nonconformities effectively, whether IT, OT, or supply chain. Training and awareness can only be as good as your strategies. Therefore, it is essential to identify where the operations and projects are exposed to threats before the hackers find them.
Training, Technologies, And Tools
Balance the investments between security awareness training, tools, and technologies. Put the right people, technologies, and processes in place to effectively build cyber-defense from cyber threats.
Provide industry-specific, personalized cybersecurity training to your employees. Cybersecurity experts do not believe in one-size-fits-all. Therefore, it’s better to educate your employees using personalized-to-industry content.
Focus On Equipment And People
Reserve the budget to upgrade your human capacities while ensuring compliance. Shift and distribute the focus from IT upgrade to the cyber-ready workforce. Businesses should certainly not reduce their investments in IT. Thus, they should expand their training programs using careful exploration.
Final Words
The cyber threat landscape for the power sector is quickly changing and growing, with more frequent attacks and a wider variety of threat actors.
Additionally, more baggage is being added by tools and malware that are becoming more sophisticated, more accessible, and occasionally used indiscriminately.
Visit our dedicated page for resources, case studies, and additional information on reducing cybersecurity risk in the energy and utility sector.
