Energy is the all pervasive fuel which drives world economies. It is no wonder that hackers regularly target energy sector companies to cause massive disruption. In a report titled “The road to resilience: managing cyber risks”, Christoph Frei, Secretary General, World Energy Council said the following:
Cyber threats are among top issues keeping energy leaders awake at night in Europe and North America. Over the past three years, we have seen a rapid change from zero awareness to headline presence. As a result, more than 30 countries have put in place ambitious cyber plans and strategies, considering cyber threats as a persistent risk to their economy.
“What makes cyber threats so dangerous is that they can go unnoticed until the real damage is clear, from stolen data over power outages to destruction of physical assets and great financial loss. Over the coming years we expect cyber risks to increase further and change the way we think about integrated infrastructure and supply chain management.”
The report contains a detailed infographic here, which provides the following insights:
- Cyber attacks in energy sector are prevalent across the globe.
- Hackers attempt to steal critical power plant designs and system passwords, gain access to critical sub-systems, etc.
- The sophistication and number of cyber attacks is growing.
- The effects of such attacks are severe and making it an attractive target.
In a more recent article from World Economic Forum titled “Hackers are causing blackouts. It’s time to boost our cyber resilience”, the authors indicate that:
“Officials from the US Department of Homeland Security publicly declared in 2018 that hackers had infiltrated the control rooms of multiple US electricity utilities to the extent that they had the ability to disrupt the flow of electricity to customers.”
Let us take an example of a more recent attack that happened earlier this month (reference: E&E News). A Western utility company fell victim to a “cyber event” that interfered with operations, but stopped short of causing blackouts, according to Department of Energy (DOE). DOE reported that the utility company did file a report indicating that a Denial Of Service (DOS) attack happened. The DOS attack took advantage of a known software vulnerability that required a previously published patch to fix, according to DOE officials.
The bottom-line – “Unpatched software continues to be a number 1 risk”, as we discussed in an earlier blog.
ThreatWatch with its Machine Powered and AI-driven Proactive Vulnerability Management on Symbolic Representations of Virtual Assets provides an Early Warning coupled with Actionable Insight for organizations to help improve their security posture. For a detailed discussion around how ThreatWatch solution can be beneficial for your organization, please contact us – info@threatwatch.io.