Cyber Defense eMagazine May 2019

Why Cyber Defense in the Power Industry is so Unique
By Gowri Rajappan, Director of Technology and Cybersecurity at Doble Engineering Company
Every organization connected to the internet is at risk of being the victim of a cyberattack. In fact, most
organizations face multiple attacks per day with varying levels of sophistication. Electric power companies
are more vulnerable than most. While most organizations have their networks in just a few locations,
making them easier to defend, power company networks are sprawling, with potential access points
everywhere.
While the adoption of new technology in the industry has done wonders for the efficiency and reliability
of assets, it has also significantly increased the opportunity for hackers to gain access to the network.
Nearly every piece of equipment in a utility’s infrastructure contains a sensor that communicates
performance data to the network. Many of these sensors represent a point of vulnerability that could be
exploited by a would-be hacker.
Speaking to Utility Dive in May of 2018, Bill Lawrence, director of the North American Electric Reliability
Corporation's Electricity Information Sharing and Analysis Center said that, "In theory, a grid with more
distributed resources can increase the potential attack surface for adversaries because the capacity of
distributed generation, including renewables, has grown exponentially over the last decade."
This creates a different level of expectation when it comes to cybersecurity. Given the vast attack surface,
it is not possible to successfully thwart every attack. It is important to have effective detection systems
that can identify threats quickly, and rapid response plans to isolate and mitigate the detected threats
before they can cause any damage.
While the management teams of most organizations would hold a fairly confident stance that their security
systems could hold up to any outside attack, power and utilities have a very different perspective. A
recent report issued by consulting firm KPMG highlighted that 48 percent of power and utility CEOs think
that being the victim of a cybersecurity attack is inevitable.
98