Hackers have their sights set on energy and utility companies
Here’s what you can do right now
Energy and utility companies have long been prime targets for hackers. But in recent years, power grid hacks have grown more frequent, and the threat they pose to national security has become impossible to ignore.
In September, the American cybersecurity firm Symantec reported that a group of hackers broke into dozens of energy firms in the US, Turkey and Switzerland as early as 2015, and in some cases were able to gain “operational access” to vital equipment. [1] In October, North Korean hackers breached an American energy utility. [2] In 2015, hackers shut off power for 225,000 Ukranians, and in 2016, they carried out the world’s first fully automated grid attack. [3]
Find out how to protect your energy company from hackers.
Not all hacks have the same intent or outcome. While some hackers, like the ones who attacked Ukraine, are looking to wreak havoc, others are simply looking to steal information.
Governments are nonetheless raising the alarm and preparing for the worst. This summer, FEMA and the Department of Energy sponsored an exercise to examine the hazards of “Black Sky” scenarios—months-long, widespread electric outages caused by natural disasters or malware attacks that could trigger global catastrophe. [4]
“Responding to ‘Black Sky’ events is all about industry in the lead and government in support,’ said former Assistant Defense Secretary Paul Stockton.
To prevent disruptions and disasters alike, experts say, the energy industry needs to invest more in improvements to identify and patch vulnerabilities in the grid. While investments to detect breaches are expensive, according to the IBM Security-sponsored Ponemon Institute’s 2017 Cost of Data Breach Study, a successful breach is even more costly.
The Angle:
The threat posed by hackers may be intimidating but it can be beat, Jeffrey S. Katz, IBM’s Head of Grid Technology for the Energy, Environment and Utilities industry, told Industrious.
Companies looking to defend themselves against cyberattacks, Katz said, should make sure they discover vulnerabilities in their systems before hackers do. Few energy companies have the personnel to do that internally, so they must rely on outside experts. [5] To that end, they can enlist IBM to conduct a North American Electrical Reliability Corp. (NERC) Critical Infrastructure Protection (CIP) evaluation or a penetration test.
“The attack vectors are there. The question is who finds them first,” Katz said.
Discover how IBM is leading the grid conversation at DistribuTECH2018.
[1] https://www.wired.com/story/hackers-gain-switch-flipping-access-to-us-power-systems/
[2] https://www.cyberscoop.com/north-korea-ics-hacking-dhs-ics-cert/
[3] https://www.theatlantic.com/technology/archive/2017/12/ukraine-power-grid-hack/548285/
[4] http://www.dailymail.co.uk/news/article-4779994/Gov-t-prepares-possibility-power-outages-US.html
[5] https://www.popsci.com/hackers-are-attacking-electric-grid
