The energy sector is attractive to hackers for a number of reasons. While there are few documented attacks on energy infrastructure, the inherent nature of the sector makes it vulnerable to hackers. Cybersecurity compliance in this sector is critical simply because of the wide-ranging impact that a successful attack can have. The hackers that targeted the Colonial Pipeline network in early 2021 not only managed to extract a $4.4 million ransom but also pushed per gallon price by six cents in affected areas and gasoline futures to their highest level in three years.
What makes energy companies easy prey for cybercriminals?
1. Highly interconnected
The energy ecosystem is complex, consisting of physical and cyber infrastructure assets distributed across regions or countries. This creates a large surface area for attack. Moreover, the operational technology of grid distribution systems is increasingly allowing remote access to business networks, allowing hackers further opportunity to create inroads to company data.
The energy sector has historically been late to adopt technology and innovate. A lack of cybersecurity expertise means energy companies have to be more proactive in managing risks.
2. More to exploit
Cybercriminals have the chance to exploit vulnerabilities in energy companies’ IT system and operational technologies. IT systems include software, hardware and technologies to run business. Operational technologies include software, hardware and technologies to control motors, pumps and valves, among other devices and equipment.
Energy companies rely on different types of hardware, software and services from third-party vendors worldwide. Attackers can access a company’s network through a third-party vendor or supplier.
3. Always on infrastructure
The energy and utilities sector is increasingly using cloud services, driven by the need for improved flexibility and operational efficiency, and reduced capital expenditure costs. This digital infrastructure supporting the energy sector works 24/7.
4. Wide-ranging disruption
The prospect of severe damage is also an attraction for cybercriminals. A single attack on a network or system in the energy infrastructure can impact a number of entities. For example, a blackout of 6-7 hours from a cyberattack on the energy grid can cause financial loss, affect social-economic life and retard daily life activities.
5. Various motivations
Reliable electricity is a convenience of modern life, and also crucial to the nation’s security and economy. The electricity grid is a prime target for cyberattacks perpetrated by hostile countries. Financial motivation (ransom) and hactivism (to promote an agenda against the oil and gas industry, for example) are prime reasons for cyberattacks in this sector.
Actions to take
Businesses in the energy sector need a multi-pronged risk management strategy to stay compliant with industry standards and government regulations on cybersecurity. Active management of supply chain risk is crucial. Hybrid identity and access management solutions combining cloud and on-premise components can help bridge the gap between IT and OT architectures.
A strong incident response plan will minimize the impact of ransomware attacks while employee training on identifying phishing and other social engineering attacks will be essential to maintaining a robust compliance posture. Last but not the least, ensuring that the company’s cloud-based infrastructure is being monitored, or effective cloud monitoring, can help eliminate potential data breaches.
