NEW YORK, NY, 31 January 2019–The network of power plants and lines connecting to homes and businesses is widely considered to be among the most critical infrastructure in the world. It’s also one of the most frequently attacked, with consequences that could potentially reach far beyond the power sector. A new Deloitte Global report, “Managing cyber risk in the electric power sector,” evaluates the biggest cyberthreats to the electric power sector and suggests how companies can manage these risks.
The electric power sector faces a rapidly evolving cyberthreat landscape – the sophistication and frequency of attacks are increasing, and the number of threat actors are growing. In fact, energy is one of the top three sectors targeted by cyberattacks in the United States. Threats can range from internal, such as an attack from a disgruntled employee, to external, from nation-states or organised crime.
The advancement of electrical infrastructure presents an interesting obstacle for cybersecurity: as grids become modernised and digitised, they become more supported by and integrated into third-party operations,
says Paul Zonneveld, Deloitte Global Energy & Resources Risk Advisory leader.
"With increasingly complex global supply chains, power companies will need to identify and map threats across the extended enterprise."
To reduce cyber risk in the supply chain, retail power companies face three notable obstacles. First, ownership of the cyber supply chain is often ill-defined, so companies must establish clear accountability. Second, as pressure mounts to move operations to the cloud, companies must do their due diligence in assuring that providers are secure. And third, companies often do not have the manpower to assess cyber risks from their vast number of suppliers.
Electric power companies can take a number of steps to overcome these obstacles and manage cyber risks across the enterprise:
Technological innovation and analytics should drive every electric power company’s cybersecurity strategy,
New tools are increasingly available, and the capability to monitor networks in real time, discover threats, and address them is advancing rapidly—providing needed protection for the industry at large.