Cyber threats to critical infrastructure like power grids have grown exponentially. State-aligned hacking groups and financially motivated criminals using ransomware are behind the dangers
Regulation is evolving to try to keep pace with the growing threats. However, the energy sector is particularly in need of help to improve cyber defences
A reliance on legacy operational technology, system complexity and the critical nature of the assets all make shoring up cybersecurity challenging
Just as critical is a focus on staff training and education. Human error will always be the weakest link in the defensive chain

In winter 2015, a video appeared online. It was made by an engineer at a regional energy provider in Ukraine following the Russian invasion of Crimea. The engineer is filming a computer screen. He watches as a mouse cursor, that he does not control, moves ominously around the screen.

His colleagues were in a similar position, locked out of their workstations and watching helplessly. They could only stand by as persons unknown methodically shut down power to surrounding areas.

“This was a goosebumps moment for all grid operators,” said Andreas Klien, a power grid cybersecurity expert at power system testing firm Omicron.

Higher risk

In the intervening years, the world has only become more dangerous. Russia’s full-scale war against Ukraine in 2022 has heightened geopolitical risks. Due in no small part to their support for Ukraine, Europe and the UK are on the frontlines of this cyber conflict.

IBM’s X-Force operates in 170 countries helping businesses prepare for and withstand cyber attacks. In its 2023 annual report, X-Force found Europe experienced the most cybersecurity incidents of any region. The most attacked country in Europe was the UK.

In early 2023, the UK’s National Cyber Security Centre (NCSC) issued a warning. It informed critical national infrastructure organisations about the emerging threat from state-aligned groups. In particular, it raised concerns around groups sympathetic to Russia’s invasion of Ukraine.

“These groups are not motivated by financial gain, nor subject to control by the state”, the NCSC said. As a result, “their actions can be less predictable and their targeting broader than traditional cybercrime actors”.

Attacks on the energy industry in particular are also on the rise. The EU’s commissioner for the internal market, Thierry Breton, said recently that more than 200 reported cyber incidents targeted the energy sector in 2023. More than half of these were directed specifically against Europe.

*Germany’s National Centre for Charging Infrastructure*

Ransom notes

Meanwhile, the danger posed by traditional cyber criminals through ransomware attacks has also soared. These groups have grown increasingly sophisticated and their capabilities have evolved. Of the cyberattacks on European energy infrastructure that it recorded in 2033, X-Force said malware accounted for 43% of cases, followed by ransomware with 22%.

“Ransomware is uniquely dangerous, in the sense that once somebody has compromised your system, they then have the ability to encrypt or restrict access to that system,” said Luke Molyneux, cyber and information security officer at consultant ABB. System backups will be one of the first things that someone running a ransomware attack might try to target, because that stops the operator from restoring the system.

“A lot of the time operators of a plant or engineers in a facility won’t quite know what’s happening,” said Molyneux. “There are a few indicators of compromise, maybe the system starts to run very slowly, and then all of a sudden, everything stops.”

A problematic legacy

There are several reasons why the energy sector is particularly vulnerable. Cybersecurity experts say the power industry is by nature slow in adapting to change.

“There is a lot more activity on cybersecurity than there was – but the grid is nowhere near as secure as it needs to be,” said Klien. The predominance of state-owned firms across Europe’s power sector means the need for rapid change runs into bureaucracy.

Then there is the grid’s complexity and its reliance on legacy equipment. This touches on the difference between information technology (IT) and operational technology (OT).

“When it comes to IT security, most European utilities are reasonably mature and have done their homework,” said Klien, noting many are certified with ISO 27000 information security standards. “On the IT side, things are progressing well. But on the OT side there is a huge gap.”

Subordinate

One illustration of the OT problem concerns substations. There, primary equipment has a lifespan of more than 30 years and secondary equipment is often in use for around 15 years.

Renovating a fleet of substations, meanwhile, can take at least a decade. Omicron has worked with utilities that are adding highly sophisticated cybersecurity measures to all new substations. The problem is that a utility might only build three or four new substations each year.

“They have a whole fleet of legacy substations that will eventually be replaced, but they aren’t doing anything about cybersecurity there,” noted Klien.

*Andreas Klien, power grid cybersecurity expert at power system testing firm Omicron*

This is a serious issue. Fears regarding a control room-style takeover – of the kind seen in Ukraine in 2015 – dominate the imagination. But the humble substation – often only protected by a small fence and a standard padlock – is also an attack vector.

“You plug in your laptop into the network switch and if you know what you’re doing you can cause a local blackout pretty quickly,” said Klien. “But the bigger problem is that substations are all interconnected. You can use one substation to attack the control centre from the bottom up, or attack other substations in the same network, planting malware that will have a co-ordinated effect in the future”.

IT vs OT

There is also a historic tension between IT and OT. This has manifested in a lack of understanding and co-operation between the two camps. To their credit, this is something that firms – including those in the energy sector – are working hard to address. But there is a lot to be done, not least because the approach to problem solving is often fundamentally different.

“If you’re an IT technician, the first thing you will ask an operator to do if they’re having a problem is restart the machine,” says Molyneux. “That’s very hard to do if you have a server that’s running a power station and all those [related] process and safety critical functions.”

In an IT system, across the CIA triad of Confidentiality, Integrity and Availability, confidentiality is seen as the top priority.

But in OT, the availability and reliability of a system are the most important aspects.

“Because not only are there enormous financial implications for turning these systems off, but there may also be safety or process critical operations that are running in the background,” said Molyneux.

This inability to shut down or turn off parts of the energy grid has contributed to the lack of understanding between IT and OT.

Cybersecurity experts report cases where IT engineers have expressed irritation that OT power grid engineers are being slow to update devices with the latest security patch. They do not seem to realise that it is in fact impossible to patch the device. To do so would require turning off power lines and transformers.

Patchwork

In cases where it might be possible to isolate and patch one device in a power grid, network complexity presents another issue.

Ideally, engineers would test a patch to make sure everything is working smoothly. But the devices in question are often complex and have hundreds of different functions. “In order to test that they are working as before, you would need to switch off everything else in the substation, which you can’t do,” said Klien.

Omicron is working on testing solutions that simulate the rest of a substation in order to test an isolated device.

But not everything can be tested this way. And applying security patches without the ability to fully test the results carries its own risk.

“The operational risk of applying a security patch in the power plant and in a substation can be higher than the cyber risk,” said Klien. “That adds a whole new dimension to risk management that energy firms need to consider.”

Regulation ramps up

The good news is that – at least in Europe and the UK – regulators are adapting to the new threats. The UK’s NCSC has a cyber assessment framework (CAF), a self-assessment tool for critical national infrastructure owners, operators and providers.

Energy regulator Ofgem has published an enhanced CAF profile for the sector. Cybersecurity experts say power station owners and operators will need to be CAF compliant probably by the end of 2025. Ofgem is negotiating dates with operators individually.

*Luke Molyneux, cyber and information security officer at consultant ABB*

“This is evidence-based self-assessment where [firms] need to say: here’s exactly what we’re doing, right the way from a board of directors-level statement of commitment down to individual things like complex usernames and passwords,” said Molyneux.

By default

Cybersecurity experts also point to the UK’s legislation on security by default. From April this year, any manufacturer of consumer smart devices must make sure those devices meet basic cybersecurity requirements.

This includes not using default passwords, providing a point of contact for reporting cyber issues and making it clear the minimum length of time for which the device will receive important security updates.

“That is just phenomenal,” said Patrik Boo, commercial portfolio manager for cybersecurity at ABB.

An industrial system not available to the public would not be covered by the law. But all the conventional office equipment, from firewall software to routers and wireless printers, should now be materially safer.

In Europe, the NIS2 Directive – EU-wide legislation on cybersecurity – came into force in 2023. The legislation requires states to have a Computer Security Incident Response Team (CSIRT) and a competent national network and information system.

A new group will facilitate strategic co-operation and the exchange of information between member states.

The legislation also seeks to create “a culture of security across sectors that are vital for our economy and society and that rely heavily on ICTs”, such as energy, transport and banking. Security experts note that under NIS2, company executives can be held responsible for corporate neglect of cybersecurity.

“That will change the game completely,” said Klien.

Integration

Firms moving to keep up with new regulatory requirements can also avail themselves of new and more sophisticated technological solutions. “Over the last five to 10 years, the number of things that could happen to you if you’re a critical national infrastructure provider or power station operator have grown exponentially. But the technology market [for] software and other systems to help has also grown alongside it,” said Molyneux.

ABB expects demand to grow for security information and event monitoring (SIEM) platforms. This is a digital software-based solution with cloud analytics that can actively collate events and look for patterns and trends, all calibrated to a specific user in a specific industry.

Yet firms have to be careful not to search in vain for a one-stop-shop solution. “My pet peeve is the notion of some vendor coming up with something that solves everything – there is no such thing,” said ABB’s Boo.

Pre-Covid, there was a trend towards companies buying expensive monitoring systems, but without considering whose job it was to monitor all the alerts that the system generates. Cybersecurity experts call for companies to properly integrate these systems into their operations. Otherwise, they risk having staff inundated with notifications or disregarding alerts amid a string of false positives.

The foundational approach to identifying cybersecurity needs, say industry experts, starts with a proper business impact analysis and risk assessment. Or as one expert puts it: 20% of the effort at the very beginning gives you the 80% of the protection possible. This requires more focus not just on equipment and infrastructure – but also staff.

A people-centred approach

More than a decade ago – so the story goes – an individual entered Iran’s uranium enrichment plant in Natanz and plugged in a USB drive. Was the individual working for a foreign power? Or were they simply a hapless employee who found the drive in a parking lot? Either way, the drive contained the Stuxnet virus. This took over the plant’s industrial control systems and used them to damage centrifuges. These days, that kind of malicious code could be contained in a charging cable.

Judith Wunschik, chief cybersecurity officer at Siemens Energy, has spoken about the importance of a people-focused approach.

Many of the devices across the energy sector – any of which could be an attack vector – are in the hands of staff who need to be properly educated and trained. Staff need to understand and appreciate that actions that might seem innocuous, may not be.

Many firms now conduct their own internal phishing operations, sending suspicious emails to try to catch employees out.

“We can’t forget that it’s humans running a lot of these systems, and they slip up every once in a while,” said Suna Taymaz, digital market development leader for the US at consultancy GHD.

In a world where AI-generated fakes can convince staff to give them access to a system, firms need to be even more vigilant, she says.

Or as one cybersecurity expert puts it: people are always going to be the weakest link.

Related Content

Tees Valley aims to transform industrial foundations into energy future

Three’s company: digital triplets power up split-second decision making

Right pieces, wrong picture for Scotland’s energy puzzle