Convergence & Digitalisation Create Problems For Energy Utilities

The convergence of previously separate sectors around renewable smart grids is creating an expansive energy value chain with widely divergent cyber security practices and vulnerabilities, eroding organisational control over energy security.

A failure to consolidate cyber security practices and policies across this new diverse value chain could result in cyber attacks causing operators severe financial and reputational damage. Fear of cyber attacks has already been found to affect consumer take-up of smart meters and poor security could hamper the success and adoption of smart grids. 

The scale of the threat is demonstrated by a recent rise in ransomware attacks targeting energy networks; from pipelines to power grids. 

Weak Links In The Energy Value Chain

Smart grids are driving the convergence of the energy and technology sectors to create efficient, flexible grids that balance supply and demand based on live data. This renders energy grids dependent on the security practices of a wide variety of third-party technology companies; from cloud providers to smart infrastructure suppliers.

The result is that responsibility for grid security is increasingly dispersed among a wider array of organisations than ever before.

Any infrastructure is only as secure as the weakest link in its supply chain, and this ever-expanding green energy ecosystem creates a bigger patchwork of cyber security vulnerabilities. Many of these suppliers now need continued access to their customer energy networks to perform remote maintenance and monitoring of energy assets, creating more potential vulnerabilities. And new energy infrastructure often interfaces with legacy infrastructure which was never designed for connectivity.

If the old, centralised energy grids resembled large walled castles with just a few gateways, the current energy system more closely resembles a multitude of mini castles with many intricate interconnections between them.

Edge Devices Create A Porous Perimeter

Edge devices such as smart appliances to sensors on grid infrastructure. These are made by an array of technology suppliers with varying standards of security, creating a diverse and distributed array of potential attack vectors.

This is further compounded by the fact that some manufacturers are sacrificing security for speed to market and rushing out new smart appliances with limited security features. As our energy security can no longer be centrally controlled, we now require new security frameworks to inform and incentivise best practice across an increasingly decentralised, disparate value chain. 

The Need For A Holistic Security Framework

Without direct control over energy security, grid operators must use cyber security frameworks to assess business risk across all cyber, digital and data projects and enforce best practice among all partners and suppliers. These frameworks should be based on best-practice standards such as IEC 62443.

Cyber security should be baked into procurement and partnership programmes from the outset so that all potential suppliers and partners are carefully vetted for compliance with security standards. Imposing cyber frameworks on Tier 1 suppliers would create a cascade of best practice cyber security as each tier of suppliers enforces the same standards on lower tiers. 

New digital or data projects should not be introduced in silos without considering their potential impact on risk across the organisation. All digital, data and cyber projects should instead be interconnected from the start so that security is baked in at design stage and risks can be continuously assessed as new technologies are added. For example, reports found that some electricity generation is vulnerable to ransomware attacks because of clean energy infrastructure that was designed without security in mind. Cyber risk assessments cannot be a one-off exercise at implementation stage but must be monitored and managed across the lifecycle of all energy assets. 

Rather than focusing narrowly on cyber risks, organisations should also get an integrated overview of business risk across all digital and data projects so that diverse digital ecosystems can be monitored and managed as a single ‘system of systems’. 

Organisations also need to manage all third-party remote monitoring and maintenance of energy infrastructure with strict user permissions to validate and verify user identities before granting access to energy networks. Any service providers with responsibility for energy data or remote access to infrastructure must be strictly vetted against a checklist of criteria.

The widening array of edge devices from mobile apps to smart meters opening new vulnerabilities to energy systems requires that all suppliers are thoroughly vetted to ensure they conduct continuous monitoring and patching of devices throughout their lifecycle.  

Steven O’Sullivan is Head of Smart Cybersecurity at Enzen 

You Might Also Read:

Process Sensor Cyber Security Is A Vital Issue:

 

« How To Improve Cyber Security Visibility & Control
Georgia Must Bolster Resilience To Information Warfare »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Montash

Montash

Montash is an award winning, global technology recruitment business, specialising in the acquisitions of high-performing talent across a number of core disciplines including Information Security.

Versasec

Versasec

Versasec is a leader in identity and access management, providing customers with security solutions for managing digital identities.

Cyber Exec

Cyber Exec

Cyber Exec is an executive search firm dedicated to global talent acquisition in Cyber Security, Information Technology, Defense...

Cyber Security Agency of Singapore (CSA)

Cyber Security Agency of Singapore (CSA)

The CSA is the national agency overseeing cybersecurity strategy, operation, education, outreach, and ecosystem development.

Armorblox

Armorblox

Armorblox stops targeted email attacks such as 0-day credential phishing, payroll fraud, vendor fraud, and other threats that get past legacy security controls.

CybeReady

CybeReady

CybeReady’s Autonomous Platform offers continuous adaptive training to all employees and guarantees significant reduction in organizational risk of phishing attacks.

HumanFirewall

HumanFirewall

HumanFirewall makes it possible for every individual to take part in securing their organisation. With HumanFirewall, achieving security has never been easier.

Tracepoint

Tracepoint

Tracepoint provide full-service cyber incident response, remediation and recovery solutions for the most time-sensitive situation your company may ever face.

Fifosys

Fifosys

Fifosys is a professional technology infrastructure specialist, delivering a broad portfolio of high quality technical and strategic managed services.

CYDEF

CYDEF

CYDEF provides comprehensive, state-of-the-art cybersecurity protection that is accessible and affordable to organizations of any size.

Symbol Security

Symbol Security

Through situational learning, simulations, and a gamified user experience, Symbol strengthens the cyber awareness of employees and helps companies lower cyber risk.

Factmata

Factmata

Factmata is an social and news media monitoring and analytics product that uses AI to identify and track narratives online, highlighting those most likely to cause brand harm or misinform the public.

Rimini Street

Rimini Street

Rimini Street is a global provider of enterprise software support products and services, and the leading third-party support provider for Oracle and SAP software products.

Silent Push

Silent Push

Silent Push maps all internet-facing infrastructure with searchable, advanced attributes, generating early indicators of potential threats that are tailored to your environment.

TIM Enterprise

TIM Enterprise

TIM Enterprise offers innovative, sustainable and secure 360-degree digital solutions to companies and public administrations.

Ebryx

Ebryx

At Ebryx, we are at the forefront of cybersecurity innovation, leveraging over a decade of expertise to protect and empower organizations worldwide.