Energy Industry

Since 2017, cyber attackers have rapidly increased their attacks on the energy industry, with 2022 reaching an all-time high for the number of attacks in a single year. To safeguard against this growing threat, energy industry leaders must take proactive measures.

Recent years have seen the energy sector fall victim to numerous cyber attacks. The year 2021 witnessed one of the largest ransomware supply chain attacks in US history executed by DarkSide threat actors, which targeted the Colonial Pipeline. The company paid the hackers nearly $5 million in digital currency to regain control of their systems.

With the growing dependence on digital systems to manage operations in the sector, it is essential to recognize that such reliance presents both benefits and vulnerabilities. Unfortunately, this growing reliance on technology has also made industrial security more susceptible to cyber threats, with the potential for more attacks like the Colonial Pipeline incident lurking in the shadows.

Throughout 2022, the cyber landscape for energy and utility companies became increasingly complex, and it was not just due to escalating geopolitical issues. A range of cyber threats highlighted the inherent vulnerabilities of critical infrastructure, which was never designed with digital transformation in mind.

Cyberattacks Security Protection for Energy

Cyberattacks on the Energy Industry in the US

The energy sector faces five major cyber threats.

Supply Chain Attacks

In supply chain attacks, threat actors access an organization's network through a third-party vendor or supplier, potentially compromising sensitive information. The Colonial Pipeline attack was a significant supply chain attack caused by a compromised VPN account, and the attackers stole data and demanded ransom.

A ransomware attack disabled Baltimore City computers in May 2019, causing millions of dollars in damages and disrupting daily life for weeks. The attackers targeted not just IT networks but also critical infrastructure. These incidents demonstrate that cybercriminals are willing to target any vulnerable system, regardless of its impact on daily life or critical infrastructure.

Incomplete Integration of Systems

The energy sector faces significant challenges in integrating its systems due to a mix of legacy and modern technology, making it difficult to patch or harden systems. Operational technology (OT) networks built on old equipment pose a challenge as they were not initially designed for internet connectivity, making security updates a big challenge.

The cyberattack in March 2019, which resulted from a known firewall vulnerability that was left unpatched, highlighted the importance of proper firmware review processes and deployment. Organizations must take a proactive approach to address the security challenges of OT networks to ensure the continuity and reliability of operations while mitigating cyber risks.

Ransomware and Incident Response

Ransomware gangs and nation-state threat actors pose a significant risk to the energy sector. Ransomware attacks can cause operational disruptions and significant costs for remediation. In addition, the absence of an incident response plan can damage the reputation of the affected organization. The increased ransomware attacks across the energy sector led US, UK, and Australian authorities to issue a joint warning about ransomware attacks on critical infrastructure.

Identity and Access Management (IAM)

IAM has become an issue for the energy sector as it tries to upgrade older and outdated infrastructure to take advantage of emerging technologies. The new technology, devices, and systems connected to utilities’ grid networks need protection from threat actors. Often, IAM systems exist in silos, resulting in inefficiency and security risks. Proper IAM processes will help energy organizations build toward a Zero Trust model and will help secure both traditional networks and cloud-based architectures. Shifting the responsibility of IAM to human resources helps ensure quick adjustments and closes vulnerabilities.

Mobile Phishing Attacks

Mobile phishing attacks targeting employees in the energy sector have increased by 161% during the second half of 2020 and the first half of 2021. The energy sector is the most targeted sector for mobile phishing attacks. Many employees used personal mobile devices or tablets to work from home during the COVID-19 pandemic. Attackers use phishing techniques to steal VPN credentials, which they use to gain access to an organization's internal network. Once in the network, attackers can locate vulnerable systems and launch attacks against flawed industrial security and control systems. Ensuring the security of mobile endpoints that employees use is crucial to mitigate the risk of phishing attacks and mobile app threats.

Why the Energy Industry?

The electric-power and gas industries are not immune to the cyber threats that plague other sectors, such as data theft, billing fraud, and ransomware. However, unique characteristics of the energy sector pose heightened risks and impacts of cyber threats against utilities.

McKinsey and Company's research indicates that cyberattacks can affect the entire value chain of electric utilities. In particular, the following potential threat impacts have been identified:

Generation

Legacy generation systems and clean-energy infrastructure, designed without security in mind, can be a root cause of cyberattacks that cause disruptions of service and ransomware attacks against power plants and

Transmission

Physical security weaknesses may lead to large-scale power disruptions to customers through remotely disconnecting services. The vulnerabilities allow access to grid control systems, posing a significant risk to

Distribution

Cyberattacks may disrupt substations, leading to regional loss of service and disruption of service to customers. Distributed power systems and limited security built into SCADA systems may cause these issues.

Network

The large attack surface of IoT devices, including smart meters and electric vehicles, poses a considerable threat to the energy sector. Cybercriminals may steal customer information, commit fraud, or disrupt services. The root cause is the limited security built into IoT devices.

The energy sector must proactively address these cyber threats and safeguard critical infrastructure. Utilities must prioritize implementing security measures across the entire value chain to mitigate the risk and impact of cyberattacks.

A Growing Number of Threats

S&P Global Energy Security Sentinel reported that the number of major cyber attacks on energy and commodities infrastructure reached a record high in a single year during the third quarter of last year.

Since 2017, there have been 45 cybersecurity incidents targeting the energy industry, with 13 incidents occurring by July 2022, the highest annual level in the last six years.

During Q3, threat actors focused on the power, gas, and nuclear sectors, with five recorded cyber attacks.

Electricity networks were the second most vulnerable, with more than a quarter of all incidents targeting them.

Since 2017, oil assets and infrastructure have been the most targeted, accounting for a third of all incidents.

Gas and shipping were the other two sectors that experienced cyberattacks.

Commodities, energy, and resources assets in the United States have been targeted more than any other nation, accounting for almost a quarter of all cyberattacks since 2017, according to the updated S&P report.

Securing Energy Systems

Governments are taking action to ensure the security of energy systems by implementing laws and regulations, promoting the use of diverse energy technologies, and collaborating with businesses to enhance industry resilience. However, organizations must adopt innovative security solutions like BlastShield to ensure the continuous and reliable operation of vital systems and services and to foster a more secure and resilient future.

BlastShield offers a powerful and practical solution for organizations seeking to enhance the resilience and security of their critical infrastructure. Leveraging software-defined perimeter technology and embracing the principles of zero-trust security, BlastShield provides a simple, effective, and cost-efficient way to protect critical systems and disrupt the kill chain of cyberattacks.

Invest in an OT solution like BlastShield to safeguard our communities and ensure the reliable and uninterrupted operation of vital systems and services.

Energy Industry Brief

The energy industry is a critical sector that powers modern society, and OT systems are essential to its operations. However, as these systems become more digitized and interconnected, they become more vulnerable to cyber threats. A successful cyber attack on the energy industry's OT systems can result in blackouts, equipment damage, safety hazards for workers, financial losses, and reputational damage due to the sensitive data involved.

Download Solution Brief