Fuel, Flow, and Firewall: Securing the Digital Backbone of Energy and Utilities

Smart Infrastructure Vulnerabilities

Smart infrastructure vulnerabilities offer cybercriminals exploitation points. Advanced metering infrastructure (AMI), as used by utilities in devices like smart meters, is increasing the attack surface and affecting customers. An academic paper from Purdue University researchers explores the AMI's attack surface. The researchers give an example of how an AMI cyberattack may use intelligence gathering to identify vulnerable targets for malware infection, exfiltrate data from various attack points, and capture control of the system.

North American Electric Reliability Corporation has identified several weak spots in electrical networks, showing that the networks' susceptibility and weaknesses are growing year over year.

Unpatched ICS Vulnerabilities

Hackers exploit vulnerabilities in Industrial Control Systems (ICS) to gain unauthorized access. The U.S. cyber defense agency, CISA, regularly publishes warnings on security issues and vulnerabilities affecting ICS.

Supply Chain Attacks

Energy and utilities are vulnerable to supply chain attacks, according to analysis by KPMG and Security Scorecard. The study shows that 45% of security breaches in the energy sector were due to third-party vulnerabilities.

The SolarWinds breach exemplifies how supply chain attacks can impact multiple energy companies. The backdoor attack on the SolarWinds monitoring platform Orion affected 25% of the electric utilities on the North American power grid.

Ransomware

State-sponsored ransomware gangs like Darkside target critical infrastructure suppliers for geopolitical reasons and extortion. The ransomware problem in energy and utilities is severe, with a CI threat report from Sophos finding that 67% of respondents said their organizations had suffered a ransomware attack. The mean cost to energy, oil/gas, and utilities organizations to recover from a ransomware attack is $3.12 M. Initial access typically uses a spear phishing email and MFA bypass methods to break extra authentication security.

Halliburton, a U.S. oil supplier, was a victim of a ransomware attack. The ransomware gang, known as RansomHub, exfiltrated a large volume of data before placing it on its dark web leak site, using it as leverage to extort the ransom payment. Halliburton breach-related losses are around $35 million.

Living-Off-The-Land (LOTL)

LOTL is an exploitation involving legitimate, built-in administrative tools, like PowerShell and PsExec. Initial access is usually via a phishing email. Cybercriminals then use vulnerabilities in these tools to execute an attack without alerting monitoring tools. They can then move laterally within the OT network, escalating privileges, again using legitimate network tools. Once hackers have enough privileges, they can initiate malicious scripts to alter programmable logic controller (PLC) settings within industrial environments to manipulate critical processes. Russia-linked hacking gang Sandworm used LOTL to attack a Ukrainian critical infrastructure organization.

Political attacks and cyber espionage

Global tensions are mounting, leading to state-sponsored threat actors' attacks on CI (critical infrastructure). The Microsoft Digital Defense Report found increased reports of attacks on internet-exposed, poorly secured OT devices that control real-world critical processes. The causes were unpatched components and default passwords. The U.S. NERC warns that "geopolitical conflict, including Russia's invasion of Ukraine and the war in Gaza, has dramatically increased the number of threats to North American power grids".

Examples include in the USA, internet-exposed OT equipment in water and wastewater systems being targeted in multiple attacks by pro-Russian, state-sponsored threat actors.

Financial exploitation

Cybercriminals weaponize critical infrastructures to extort large ransoms. Resecurity researchers have described how this tactic is driving ransomware operators targeting energy firms to increase their extortion demands beyond $7 million.

Data

Energy and utilities hold valuable data, including customer and company-sensitive information. The Thales Data Threat report found that 42% of critical infrastructure companies, including those in the energy sector, suffered data breaches.

Robust Identity Management

Unauthorized access to OT/IT resources is behind many cyberattacks on the sector.To mitigate identity security-focused attacks, enforce the principle of least privilege (PoLP) to ensure access is controlled on a need-to-know basis. The use of Just-in-Time (JiT) access limits access to only when needed. Add in phishing-resistant MFA to prevent multi-factor authentication bypass tactics. Use Privileged Access Management (PAM) from vendors like One Identity to manage access privileges.

Train Your Team

Security awareness training is essential to cybersecurity preparedness. Educating staff and associates on the tactics used by cybercriminals to manipulate behavior and on security hygiene issues like safe password use helps to create a culture of security. Vendors like TitanHQ specialize in behavior-led security awareness training.

Network Segmentation

By segmenting areas within an OT network, a critical infrastructure organization can isolate areas to contain the spread of a cyberattack.

Update Software

Ensure that your software and firmware are patched and up-to-date to prevent vulnerability exploitation. Always change default passwords on IoT devices to something more secure, and where possible, use MFA.

Dark Web Monitoring

Services like Sentinex help enable an energy and utilities organization to identify threats lurking on the dark web. This includes locating potentially stolen company and customer data and potential threats to the organization.

Get Cyber Insurance

Cyber insurance can help with costs after a cyberattack. Insurance may cover losses associated with failure to supply, fines, noncompliance outcomes, enforced shutdowns, property damage, etc. Some cyber insurers, like Canopius, offer specialist coverage for utilities.

Monitor and Detect

IDS tools monitor network traffic in real-time, looking for unusual or anomalous activity that may signal a cyberattack. Monitoring tools for IOT networks help to identify these anomalous patterns across external remote connections that could signal a cyberattack. Web application firewalls (WAFs) are another tool to control network traffic between zones within an OT network and help prevent unauthorized access to critical assets.

Review the Security Posture of Connected Third-Party Suppliers

Supply chain attacks are used to exploit critical infrastructure organizations. Put robust supply chain risk management processes in place, checking the security posture of each vendor.

Create a Response and Recovery Plan

If the worst-case scenario does occur, having a well-thought-out response and recovery plan can help mitigate the attack. A response plan is a written document that outlines the steps to contain and mitigate the attack. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) offers some guidelines for creating an effective plan.