Cyber Security in the Energy Sector Douglas DeGrote April 2015
The Importance of Cyber Security The field of affect has changed More control systems and critical infrastructure is online The ability to cause widespread issues is greater than ever before The level of destruction in attacks has increased significantly The reliance on digital technology has multiplied each year The frequency and complexity of threats has made prevention very difficult The number of bad actors continues to increase
Increasing Scope of Security in Utilities Traditionally most of the control operations of generation, transmission and distribution were isolated systems This has changed dramatically over the past several years The criticality of electricity within dependent industries has increased significantly Communications, digital information and powered technology have become core to services delivery Threats have changed to much more than stealing information The intent of harm is much more prevalent…and increasing
The Changing Threat Landscape Attacks used to focus on the real target Now focused on supporting and inter-dependent infrastructure Energy is Key – electricity is “Core” to most everything Attack vectors have changed Not just malware and brute force breaches that can be “seen” Advanced Threats require more behavior analysis to detect The actors have changed Although there are still the “Script Kiddies” out there, we now face nation state and military based actors The speed of affect gives little time to react Technology today moves so quickly that reaction time can lead to much greater damage
The Answer Cannot Be Internalized Vendors and service providers bring risk A good vendor risk management program is needed Physical attacks compound the danger of a cyber attack We’ve become more reliant on visibility to, and remote control of asset operations Threat information sharing and cross industry analysis is becoming critical Need to have the “big picture” in order to protect the pieces Regulations can help drive improvement Findings that drive security investment would be more beneficial
The Good News Is… We’ve made cyber security a priority We’ve made significant improvements already Information sharing has become a focus and will bring even more improvements to threat understanding and our ability to identify and stop attacks
In summary Cyber Security is core to protecting our critical infrastructure This is a quickly moving target and requires consistent and constant concentration There is no “silver bullet”. We need to be prepared to react and recover just as much as we need to protect. We need to work together within and across industries We’ve made good progress, but there’s more to do
THANK YOU
Recommend
More recommend
