Report: Energy Sector Security Improvements Imperative

A new report from McAfee details the thoughts of industry leaders on the state of energy security. The report, Getting Smarter About Smart Grid Cyberthreats, looks at how legacy smart grids are vulnerable to attack and how security needs to be built into these critical systems, according to a press release.

A cybercriminal could debilitate a major city by a single targeted attack on the energy grid and compromise anything from the lights and appliances in homes, to heart monitors in hospitals, to air defense systems, the press release states.

According to the report, the most prevalent cyberthreat reported by the global energy sector is extortion. Criminals gain access to a utility's system, demonstrate that they are capable of doing damage, and demand a ransom. Additional threats include espionage and sabotage all with the goal of financial gain, data theft and shutting down facilities.

Within well-intentioned efforts to modernize energy distribution and make it safer, cleaner, more efficient, less costly, and open to more alternative forms of production, the energy sector has made smart grid technology vulnerable. According to the release, particular reasons include:

Outdated systems – An estimated 70 percent of the existing energy grid is more than 30 years old. In the effort to update it and integrate it with more modern installations, connecting aging systems to the Internet without the benefit of encryption, security has largely been an afterthought.
Automation – Moving systems from a manual process to one that is Internet-connected gave energy grid operators real-time info and allowed administrators to telecommute and field workers to re-program systems from remote locations through their smartphones however this also opened all their systems to the outside world.
Interconnection of embedded systems – The third and perhaps most alarming cause of vulnerability is the proliferation and increasing interconnection of embedded software and devices directing the flow of energy. While each of these built-in computers is typically single-function with a very specific task, more and more are being built with off-the-shelf rather than proprietary software, making them increasingly generic - and therefore vulnerable. As such, they are the prime targets of intruders seeking to gain control of or disrupt the delivery of energy.

A wide range of technologies exists for achieving the goal of securing these embedded systems and the energy grid – from antivirus and anti-malware protection to firewalls, advanced encryption, and application blacklisting and whitelisting, the report says.