Critical Infrastructure Is The Next Target

Zaporizhzhia Nuclear Power Station, Ukraine

The way we think about cyber-attacks changed in December 2015, when Ukraine experienced the first recorded power outage caused by a cyber-attack.

It didn’t last long, between one and six hours, depending on the area, but it showed the government, industry, and the public how these attacks could affect the physical world. It’s not just personal information and other sensitive data that’s at stake. Critical infrastructure is now under threat.

Advances in information technology and operational technology carry new benefits and risks for many companies. Technological developments not only allow for more efficient management of industrial and process control systems but also increase the attack surface of the organization, making them more vulnerable to cyber threats.

The New Mandate

In May 2016, the G7 Energy Ministers released a joint statement that announced their commitment to “advancing resilient energy systems including electricity, gas, and oil, in order to respond effectively to emerging cyber threats and to maintain critical functions.”

This is the latest in a series of movements around the world to protect data and critical infrastructure. The most immediate actions confronting organizations operating in the EU are the General Data Protection Regulation, which contains some of the most stringent privacy requirements anywhere in the world, and the Network and Information Security Directive (NISD). The NISD will have a significant impact on companies operating critical infrastructure across all major sectors, including the energy sector.

European Commission Vice-President Andrus Ansip described how the NISD will require “companies in critical sectors, such as energy, transport, banking, and health, to adopt risk management practices and report major incidents that can affect the Digital Single Market to their national authorities, which will, in turn, be able to carry out better capacity-building with greater cross-border cooperation inside the EU. It also obliges online market places, cloud computing services, and search engines to take similar security steps.”

The Digital Single Market is an EU initiative that aims to remove existing online barriers for goods and services across the EU.

Once the NISD is adopted, expected this month September 2016, EU member states will have 21 months to integrate the ruling into their national laws, and then six additional months to identify operators of essential services that it affects.

Moving Beyond Protection

The cyber-threat landscape is continuously evolving, with new attack techniques discovered on a daily basis. Organizations across all sectors, including those in the power and utilities market undertaking large technology transformation programs, face an enormous challenge.

On one hand, they have no choice but to embrace the new hyper-connected digital world and all the benefits that new communication channels and platforms bring to the business. But on the other, they must defend against advanced cyber threats as their risk increases exponentially.

The energy sector’s long-held belief that all cyber breaches can be prevented is no longer valid. The incident in Ukraine proved that the era of prevention is over. A new wave of targeted cyber-attacks could prove too sophisticated even for the most-advanced cybersecurity defense programs.

Preventative controls such as firewalls, access management, and antivirus systems remain an important part of any cybersecurity program, but investment in monitoring capabilities, threat intelligence, and incident management is needed now. Utilities must be able to identify when an attack is taking place and be ready to set response mechanisms in motion when a breach occurs. They must build an active defense.

It sounds easy enough but, in reality, the energy sector lags behind most other sectors. EY’s most recent Global Information Security Survey revealed that 42% of power and utilities companies say it’s unlikely they would be able to detect a sophisticated attack. The best place to start is by understanding what assets they need to protect and how attacks could play out. This will, in turn, drive the development and implementation of targeted countermeasures.

The protection of critical infrastructure against advanced cyber threats in an increasingly interconnected and borderless digital world is one of the most pressing challenges that energy companies face today. Cybersecurity doesn’t inhibit developments in the digital world; rather, it helps make the digital world fully operational and sustainable. And a tailored and risk-centric approach to cybersecurity will adjust the balance of the digital world back toward sustainability and safety.

After all, it’s just a matter of time before the next attack strikes.

Dark Reading

« Canadian Companies Vulnerable To Cyber-Attacks
Cybercrime & Cyberwar: A Spotter's Guide »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

AML Solutions

AML Solutions

AML Solutions offer a full range of Anti-Money Laundering and Countering the Financing of Terrorism (AML/CFT) services.

Cloudbric

Cloudbric

Cloudbric is a cloud-based web security service, offering award-winning WAF, DDoS protection, and SSL, all in a full-service package.

Center for Strategic Cyberspace & International Studies (CSCIS)

Center for Strategic Cyberspace & International Studies (CSCIS)

CSCIS seeks to advance global cyberspace security and prosperity by providing strategic insights for cyberspace and policy solutions to decision makers.

SecuDrive

SecuDrive

SecuDrive, provides hardware encrypted external storage devices to protect a company’s sensitive and important data.

WetStone Technologies

WetStone Technologies

WetStone develops software solutions that support investigators and analysts engaged in eCrime Investigation, eForensics and incident response activities.

Fidus Information Security

Fidus Information Security

Fidus is a team of security professionals providing Penetration Testing and Cyber Security Consulting services throughout the UK and worldwide.

Cyber Security Audit Corp (C3SA)

Cyber Security Audit Corp (C3SA)

C3SA specializes in architecting, operating, managing and improving defensible and resilient IT infrastructures for Canada's public and private sectors.

IFE Digital Systems

IFE Digital Systems

IFE Digital Systems conducts research, development and consultancy in risk, safety and security related to digital systems in critical infrastructure.

Nexor

Nexor

Nexor are a UK-based cyber security company with 30 years' experience in secure information exchange.

Netography

Netography

Netography provides a scalable and reliable platform for detection & remediation of cyber threats found on your network.

Accurics

Accurics

Accurics enables self-healing cloud native infrastructure by codifying security throughout your development lifecycle.

Smoothstack

Smoothstack

Smoothstack is a technology talent incubator whose immersive training program kick starts IT careers and delivers a fresh source of IT talent.

Josef Ressel Centre for Intelligent & Secure Industrial Automation

Josef Ressel Centre for Intelligent & Secure Industrial Automation

The Josef Ressel Centre for Intelligent and Secure Industrial Automation investigates the fundamentals of digital assistants for industrial machines that enable intelligent and secure operation.

Tychon

Tychon

Tychon develops advanced enterprise endpoint management technology that enables commercial and government organizations to bridge the gap between security and IT operations.

TELUS

TELUS

TELUS provide Canadian businesses with the services and solutions they need to securely thrive in a digital world. Partner with a cybersecurity leader you can rely on.

Ark Infotech

Ark Infotech

Ark Infotech is a provider of cloud management services, selective support services, and technology solutions.