Cyber security in the energy sector: A danger to society
Cyber security should be the issue on the mind of every CTO, technology leader, CEO and board member. And if it’s not…
When considering cyber security, and in particular cyber security failings, we instantly think about data breaches. This is what keeps those in charge of security up at night. Depending on the organisation, the size and the structure, this could be the CTO – as is the case, in part, with Microsoft UK – or the CISO, or a head of security. There are many positions that have the responsibility of cyber security at its heart.
Data breaches are a significant issue, especially at a time when the question of privacy (or lack of) is at an all time high. This is why more stringent data protection regulations – like the EU GDPR and the California Consumer Privacy Act – have and are coming into force.
However, while data breaches are prevalent, the subject of cyber security in the energy sector should be of perhaps greater concern. Over the last couple of years, attacks on critical infrastructure have surged, and the potential repercussions are significant. A loss of data is concerning, but a loss of electricity and water is catastrophic to both business and society.
As a result, Information Age wanted to find out about Cyber Security in the Energy Sector – the attitudes, the challenges, the solutions.
Cyber security should be treated with the utmost importance in the energy sector
King has over 20 years of professional work experience in the IT and cyber security fields, with a strong focus in the energy sector. He developed and ran a fortune 250 energy company’s combined utility cyber security program. On top of this, he also chaired a cyber security CISO collective of the USA’s 14 largest electric utilities, acted as a board member for the American Gas Association’s Cybersecurity Task Force, participated in the Edison Electric Institute’s Cybersecurity working group and was a board member for EnergySec.
Darktrace – a cyber security company – works with Drax – a leading power infrastructure company, providing around 7% of the UK’s power – to help defend its IT systems from cyber attacks. In the past, Drax took the traditional approach to cyber security using several firewall layers, but realised that no matter how good your firewalls are, there was always the risk of a breach. Drax uses data to manage all of its business units, and the IT team are consistently seeing breach attempts. They turned to Darktrace and its innovative, AI-led approach to stopping cyber attacks. So, both Tsonchev and Sloan are well placed to discuss the changing state of cyber security in the energy sector, and the dangers posed.
Cyber security, as it should be, is a concern for all organisations and the energy sector is no different. “Stuxnet, a malicious computer worm that targeted SCADA (supervisory control and data acquisition) systems in 2010, was a watershed moment for the sector,” explains Sloan. “It showed how a cyber attack can have a serious impact on the physical, as well as the digital, world.”
“Generally speaking for the larger utilities, cyber has become a strong board focus and is a discussion point in every strategic planning and risk management session,” says King. As with any other business or industry, security cuts across almost every utility business function.
“The main emphasis is managing cyber risk in a similar way to other risks,” continues King. “That leads to top down leadership support, but only if the utility has employed a cyber security leader that can effectively translate the deeply technical work that the cyber team performs.” This relates to explaining the terms of risk and impact to the executive and board teams, in an understandable and relatable way.
Scott King has been a huge advocate for, and force behind, building better cyber security practices and approaches in the energy sector
The energy sector is evolving, and its cyber security has to evolve as a result. “Power grids are fast becoming digital jungles,” explains Tsonchev. As with any other industry, new technology innovations – like IoT sensors, smart meters and integrated cloud services – are being integrated with legacy hardware and software. “Whilst this is enhancing efficiency and customer experience, cyber criminals are increasingly targeting these innovations to undermine their benefits,” says Tsonchev.
“As an integral part of national critical infrastructure, whether you’re a well-resourced criminal group looking to cause disruption and damage, a nation state seeking to spread your political message, or simply to posture on the world stage, the energy and utilities sector is an alluring target.”
Overlooking cyber security in the energy industry is not an option. The risks posed are to great.
“The utility industry, and energy industry in general, have a massive societal impact. And when impacts to service delivery are incurred, it can have a massive and immediate negative effect on the population of a region,” confirms King. This is not a case of financial and reputation loss, it is a case of societal collapse.
“When you review the geo-politically motivated cyber attacks on Ukraine utilities in 2015 and 2016, you can begin to understand the societal damage that can occur, and how an extended impact would result in disruption of life and potentially civil unrest,” continues King.
Tsonchev also alludes to the cyber attacks on the Ukrainian grid. Since then, “high-profile attacks on power grids have continued to hit the headlines, exposing the significant vulnerabilities in traditional security tools. Patches simply do not exist for some of these older systems, or at best, applying them is prohibitively difficult and costly,” he warns.
“Stakes are high in the energy sector, because cyber security is entangled with public safety as well as environmental concerns.”
Andrew Tsonchev believes it’s “not difficult to imagine a hacker gaining access to IoT devices”
Similar to other businesses, a successful cyber attack on an energy provider would hinder business efficiency. But, it would also impact on public safety and well-being.
Drax, as critical infrastructure, has always had very good, very high levels of security, according to Sloan. “However, no matter how good your security is, you are always subject to attacks and are always vulnerable to defeat.”
“Many companies and organisations only make changes to their security procedures as a reaction – when they have suffered a breach or a particularly bad attack. This is not the sensible approach. We are attacked all the time and so employ a ‘belt-and-braces’ form of protection, of which Darktrace is a part.”
There is now a need for new cyber security technologies that can detect threats before they can “escalate into a crisis,” continues Sloan. “More and more companies are taking this threat seriously and turning to cyber AI.”
- Head of Penetration Testing
- United Kingdom
Head of Penetration Testing needed to join a security consultancy that are delivering client facing penetration testing services around Web app and Infrastructure. Looking for someone hands on that is able to manage a highly skilled technical team of testers. 50-60% of the time is expected to be hands on, other duties will include, but not be limited to; leading and managing the day to day running of the team, mentoring, team upskill, recruitment, reporting, escalation, process improvement etc. Flexible location although south east is preferred. Anyone with Check / CREST experience is highly desirable. MUST be able to achieve SC clearance. UK based role. All details kept in confidence.
- CONTRACT SOC Manager. London / Birmingham. URGENT Immediate role.
REF7847 Contract SOC Manager. SC cleared, London / Birmingham. Initial 3 month Contract. SOC Manager needed to for an URGENT 3-4 month CONTRACT. SC clearance is essential. The project is to aid in the setup, implementation and management of resources to help with the initial stand up stages of a new SOC within a greenfield site. This is a short term contract role whilst a permanent hire is brought on over the coming 3 to 4 months. Experience engaging with and managing client stakeholder relationships as well as 3rd party relationships is critical. The role will involve; setting up, implementing and fine tuning the various initial stages of a SOC environment. Experience establishing and building out technical process / operational capability, managing of technical teams (analysts, engineers and architects, creation of policy / playbooks, fine turning is key. SPLUNK is the tooling of choice… Interviewing immediately. Set up a call with me today on https://calendly.com/chris-holt/arranged-call-with-chris-holt-remote-soc-role Direct contact details Chris.Holt@dclsearch.com or 07884666351
- SPLUNK Level 3 SOC Consultant, SIEM Splunk, London / Birmingham
REF CH7825 Level 3 SOC Consultant, SIEM Splunk, London / Birmingham £55,000 + Level 3 SOC Consultant, SIEM SPLUNK needed. Security Clearance. Permanent role Level 3 SOC Consultant, SIEM SPLUNK needed to join a public sector client. The ability to achieve SC clearance is essential. MUST have experience working with SPLUNK ideally to an Advanced Power User level. Splunk Enterprise Security (ES) knowledge and hands on experience highly desirable. The role will include, but not be limited to; managing and handling incidents end to end, supporting and mentoring level 1 / level 2 staff, supporting the SOC manager in the delivery of the SOC roadmap, engaging with the client stakeholders (other technical teams) as and where needed, use case development, advanced search and reporting etc. The individual MUST currently be living in the UK and be able to achieve UK security clearance. (SC) This is a permanent role To arrange a call with Chris Holt use this calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-remote-soc-role Chris.Holt@dclsearch.com
- Aspiring Cyber Partner. Business lead, market maker.
Aspiring Cyber Partner (management consultancy) with Cyber specialism into Healthcare, Utilities and or Public Sector. Working with new and existing clients to help them solve, transform or evolve their cyber capabilities. MUST have; A proven management consultancy background in cyber. A history of identifying and closing new business opportunities. Currently Revenue generating / must be able to demonstrate recent wins. Client facing to board level with international businesses. Team leadership / mentoring experience. Extensive cyber industry experience. Digital transformation, Start-up environments etc. Experienced presenter at industry events, to be the public face of a business / capability. Breadth of knowledge across Cyber security. Service definition / creation. Would consider a senior director with experience delivering the above looking to step up. All conversations kept in confidence. To arrange a discreet call book a time to speak in my diary via https://calendly.com/chris-holt/cyber-partner-call Chris.Holt@dclsearch.com