Why the utilities sector must mitigate threats from outside and within By Alastair MacLeod
Utilities represent part of the critical national infrastructure in the UK, and are prone to cyber threats, even in peacetime. Foe, and believe it or not, friends, are constantly gnawing away at network weaknesses to determine resilience and potential holes.
This digital battlefield is being fought in myriad ways – from disruption to enterprise systems that underpin a utility company’s commercial and human operations, to more malign intervention of operational technology, designed to inflict severe disruption to civil society.
The ‘AcidRain’ malware attack in February 2022 caused severe, prolonged disruption to operations on a mass scale. The attack wiped out Viasat’s KA-SAT broadband service’s satellite modems, impacting thousands in Ukraine and further across Europe. The 1997 UK floods caused wholesale loss of clean water supply in a number of regions, and in 2021, a cyberattack forced operator Colonial Pipeline to temporarily shut down 5,500 miles of pipeline. Moreover, the hostile intervention in Ukraine has led to the disabling of energy – in this case, wind farms.
Ultimately in the age of IoT, where machines in the home, commerce and throughout industry are given an identity and the ability to communicate, this risk is only set to increase.
Countering the threat
According to IBM, the Energy industry ranked fifth in overall data breach costs in 2021, and security in the utilities sector brings with it additional considerations: it is a highly regulated industry where breaches can be prohibitively costly by any other industry’s standards. Moreover, costs associated with ransomware or cyberattacks can quickly escalate. Between 2020 and 2021, there was a reported ten percent increase from $3.86 million to $4.24 million per data breach incident. Then there is the length of time it takes to discover a breach; often the longer the breach goes unnoticed, the more expensive and/or disruptive the incident. And finally, there are the fines incurred from regulatory bodies. All that, before we get on to reputational damage.
Cyber security is already top of mind for many utility firms and thankfully there are many ways to counter these threats; starting with recognizing this inherent vulnerability and embedding a culture of awareness that shapes more secure behavior, processes, and system design.
Securing networks
Risk increases when or if data is exposed to the open internet, which is why utilities must leverage control using the latest IP technology – securely operating within public networks or operating via secure, private networks. Private networks, and dedicated hubs, such as those within a TSAT satellite system, maintain a vital air gap between telemetry and control, and open public networks. Enterprise systems on the other hand are often routed through internet protocols, are inherently more visible and therefore exposed. Ideally then, SCADA and telemetry data will not be mixed with enterprise traffic. Secure separation helps ensure this data doesn’t fall into the wrong hands.
The here and the now
As IoT becomes more embedded in industry day-to-day, it becomes vital that all devices and local networks associated with a grid carry technology and software to protect them.
One such way is SD WAN technology (software defined, WAN) which keeps data locked from the outside world. This technology also ensures consistent application performance and resilience by automatically steering traffic in an application-driven manner based on business intent, security protocols and WAN architecture.
One of the benefits of telemetry data is its relative size. Because telemetry data requires less bandwidth than much of the traffic going over an enterprise system, it can be more difficult to trace. Primary bearers and platforms will need to have alternatives and back-ups in place though, which means satellite, LTE, 4G/5G solutions.
In our recent paper, ‘Data’s journey in shaping digital transformation in Utilities, and what it all means’, we examine how data has been a catalyst for digitalization among companies within the utilities sector, and how outages and supply interruptions result in huge financial burden and penalties for the supplier, and severe (often prolonged) disruption for consumers.
Which brings us back to the beginning; being aware of the risks, including an acceptance that they may come from closer to home than one might at first think, is as critical as the data that needs protecting.
For a list of the sources used in this article, please contact the editor.
Alastair MacLeod
www.groundcontrol.com/en/
Alastair MacLeod is CEO at Ground Control. Established 20 years ago in 2002, Ground Control uses satellite and cellular technology to connect people and things, particularly within hard to reach, remote areas – from wind farms to fishing fleets and first responders to forestry workers.
Ground Control designs and builds its own hardware covering the entire spectrum of connectivity requirements, with manufacturing facilities in the UK, and in the United States.
The company’s long-term partnerships with airtime providers such as Inmarsat and Iridium mean that it has access to the most competitive and comprehensive airtime plans, taking full advantage of their service evolutions in ways that make Ground Control’s customers’ challenges easier to solve.