It’s a surprise to no one that computer systems need enhanced protection to reduce their susceptibility to cyberattacks, as recent events such as the WannaCry and NotPetya attacks have shown us. These infestations proved that government operations and critical infrastructures are as much at risk as corporate systems.

Of particular concern are energy distribution systems, which support nearly every activity in modern society. With this in mind, security professionals at energy companies are exploring ways to protect their operations and our way of life.

Expert Advice on Enhanced Protection for the Energy Sector

Below is a short interview with Gordon MacKay, chief technology officer (CTO) at Digital Defense, Inc. He works with chief information security officers (CISOs) across a variety of industries to help them devise protection strategies.

QuestionIs there some tool, set of capabilities or procedure that power companies should abide by that can minimize or eliminate the possibility of large-scale disruption of the power systems?

MacKay: As part of my own experience in interacting with information security professionals within the energy sector, the overwhelming consensus is there is no silver bullet solution to these threats — reducing the risk of such events includes a multipronged approach. A general, common strategy includes an encompassing cybersecurity defense program, which is driven from the top executive level that permeates the entire organization and includes a significant cyberdefense budget.

What advice do you offer energy providers’ CISOs regarding where to start or prioritize their efforts to protect their assets from cyberattacks?

MacKay: The list of prioritized items is lengthy and depends on the threat model, but a general proposed prioritized list includes:

  • Security awareness training — it’s a must;
  • An ongoing, enterprisewide vulnerability management program (not just parts of the network, but all assets, even cloud assets);
  • An incident response (IR) program that includes internal, tangible threat attack data from deception technology, intrusion detection systems (IDS) and intrusion protection systems (IPS) correlated versus threat intelligence and asset vulnerability data, a threat hunting program, and a multitiered security analyst team as part of the IR program response; and
  • A set of sound security measurements so as to gauge the effectiveness of the program, which is fed back into it for the purpose of continuous improvement.

hat is the best way to assure that your employees understand what is at stake and how to best safeguard their company?

MacKay: One of the topmost initiatives an organization must take on is to educate the entire employee base on security risks on an ongoing basis. More so, this education program ideally should be disseminated from the top executive level downward and ensure employees are fully engaged, positively enlightened and motivated to help protect the organization. There are security awareness programs on the market that help with this, but of course, it all starts with the intention and motivation of the organization.

So while cyberattacks against critical infrastructure areinevitable, the best defenses start with training, but don’t end there. Power providers need to increase their awareness of their assets and be able to monitor and quickly respond to threats.

MacKa: By including intelligence on what is vulnerable in the network, alongside other threat intelligence and security incidents, the organization is able to automatically lower priority on certain threat events for which assets are not vulnerable in favor of threat events related to assets that do have significant vulnerabilities.

Listen to the podcast: Nuclear Facilities Under Attack And Cross-Industry Lessons In Cybersecurity

more from Energy & Utility

X-Force 2022 Insights: An Expanding OT Threat Landscape

This post was written with contributions from Dave McMillen. So far 2022 has seen international cyber security agencies issuing multiple alerts about malicious Russian cyber operations and potential attacks on critical infrastructure, the discovery of two new OT-specific pieces of malware, Industroyer2 and InController/PipeDream, and the disclosure of many operational technology (OT) vulnerabilities. The OT cyber threat landscape is expanding dramatically and OT…

Lessons Learned by 2022 Cyberattacks: X-Force Threat Intelligence Report

Every year, the IBM Security X-Force team of cybersecurity experts mines billions of data points to reveal today’s most urgent security statistics and trends. This year’s X-Force Threat Intelligence Index 2022 digs into attack types, infection vectors, top threat actors, malware trends and industry-specific insights.  This year, a new industry took the infamous top spot: manufacturing. For the first time…

A New Cybersecurity Executive Order Puts the Heat on Critical Infrastructure Suppliers

Ransomware. Five years ago, the cybersecurity community knew that term well, although among others it was far from dinner table conversation. Times have changed. Since early 2020, ransomware has hit a slew of headlines. People inside and outside of the security industry are talking about it, and many have experienced the ransomware pain firsthand. The IBM Security 2021 Cost of…