By Gowri Rajappan, Director of Technology and Cybersecurity at Doble Engineering Company
Every organization connected to the internet is at risk of being the victim of a cyber attack. In fact, most organizations face multiple attacks per day with varying levels of sophistication. Electric power companies are more vulnerable than most. While most organizations have their networks in just a few locations, making them easier to defend, power company networks are sprawling, with potential access points everywhere.
While the adoption of new technology in the industry has done wonders for the efficiency and reliability of assets, it has also significantly increased the opportunity for hackers to gain access to the network. Nearly every piece of equipment in a utility’s infrastructure contains a sensor that communicates performance data to the network. Many of these sensors represent a point of vulnerability that could be exploited by a would-be hacker.
Speaking to Utility Dive in May of 2018, Bill Lawrence, director of the North American Electric Reliability Corporation’s Electricity Information Sharing and Analysis Center said that, “In theory, a grid with more distributed resources can increase the potential attack surface for adversaries because the capacity of distributed generation, including renewables, has grown exponentially over the last decade.”
This creates a different level of expectation when it comes to cybersecurity. Given the vast attack surface, it is not possible to successfully thwart every attack. It is important to have effective detection systems that can identify threats quickly, and rapid response plans to isolate and mitigate the detected threats before they can cause any damage.
While the management teams of most organizations would hold a fairly confident stance that their security systems could hold up to any outside attack, power and utilities have a very different perspective. A recent report issued by consulting firm KPMG highlighted that 48 percent of power and utility CEOs think that being the victim of a cybersecurity attack is inevitable.
According to KPMG’s Global Sector Head of Energy and Natural Resources, Regina Mayor, “Technology-driven opportunities in the power and utility sector have also opened the door for significant risks and cyber threats, which feature highly on CEOs’ and board agendas.”
Where is the security focus?
Keeping operations running and ensuring the safe and continuous flow of power has always been at the top of the agenda for power and utility companies. However, the escalation of cyber threats and attacks have caused company boards and C-level leadership to reprioritize some of their efforts.
In recent years, the rise of nation state-based adversaries, motivated by the ability to shut down the operation and cut the flow of power, has driven much of the conversation. An emerging issue for power and utility companies these days is protecting customer data. Meeting customer expectations around data security is a priority as this directly impacts business performance and company value. For a distributed utility network with multiple access points, both are challenging without the right approach.
In KPMG’s report, the firm highlights the role security plays in operations today, stating, “CEOs understand the importance of protecting customer data but emphasize the need to better meet customer expectations. Nearly two-thirds of all CEOs in the survey said that protecting customer data is critical to enabling growth in their future customer base.”
How are they adjusting?
The good news is that power and utility companies have recognized the need for increased vigilance across the grid and are investing heavily in these areas. Cybersecurity specialists are among the most in-demand positions for power and utility companies.
With a well-earned reputation as technology laggards, the utility industry is giving a much greater effort to modernize more quickly and keep pace with the technological developments of other industries.
To address the issue of cybersecurity in any sort of meaningful way, utility companies need to adopt a big picture view and assess which assets need to be protected, where they are in the network, how the workforce should interact with those assets, and more. They then need to design a holistic solution that coordinates across silos to secure these assets. Industrial security today isn’t insular. It’s not homegrown. It’s collaborative and intentional.
With every new opportunity comes a new threat. The electric grid is more robust and stable than ever before, but emerging cyber threats have made life more complicated for those charged with the safe delivery of this critical resource.
Being vigilant and making a commitment to cyber defenses and technology will allow power and utility companies to keep pace with adversaries and increase their ability to thwart attacks on their unique and vital infrastructure.
About the Author
Gowri Rajappan is the Director of Technology and Cybersecurity at Doble Engineering Company. He graduated with a doctorate in Electrical Engineering from Northwestern University in 2001 and has since spent over 15 years as a technology entrepreneur with extensive expertise in product development. For more information, reach out to Gowri at [email protected] or at our company website
;
We are in our 11th year, and Global InfoSec Awards are incredibly well received – helping build buzz, customer awareness, sales and marketing growth opportunities, investment opportunities and so much more.