Managing cyber risk in the electric power sector: Deloitte Global report

NEW YORK, NY, 31 January 2019–The network of power plants and lines connecting to homes and businesses is widely considered to be among the most critical infrastructure in the world. It’s also one of the most frequently attacked, with consequences that could potentially reach far beyond the power sector. A new Deloitte Global report, “Managing cyber risk in the electric power sector,” evaluates the biggest cyberthreats to the electric power sector and suggests how companies can manage these risks.

The electric power sector faces a rapidly evolving cyberthreat landscape – the sophistication and frequency of attacks are increasing and the number of threat actors are growing. In fact, energy is one of the top three sectors targeted by cyberattacks in the United States. Threats can range from internal, such as an attack from a disgruntled employee, to external, from nation-states or organised crime.

"With increasingly complex global supply chains, power companies will need to identify and map threats across the extended enterprise."

To reduce cyber risk in the supply chain, retail power companies face three notable obstacles. First, ownership of the cyber supply chain is often ill-defined, so companies must establish clear accountability. Second, as pressure mounts to move operations to the cloud, companies must do their due diligence in assuring that providers are secure. And third, companies often do not have the manpower to assess cyber risks from their vast number of suppliers.

Electric power companies can take a number of steps to overcome these obstacles and manage cyber risks across the enterprise:

• Map infrastructure assets and evaluate vulnerabilities: Electrical power companies should map infrastructure assets and prioritise them by cruciality. They should next determine the vulnerabilities of assets and assess the maturity of the control environment for managing threats. And finally, companies should build a framework for protecting critical assets using people, processes and technology.
• Evaluate suppliers’ security processes: To manage cyber risk in the supply chain, a promising first step is to engage with the supply chain procurement function. Electric power companies must understand suppliers’ cybersecurity processes for products and services and assure that they comply with leading industry practices.
• Engage with industry peers and government agencies: Managing cybersecurity risk should not stop at the individual enterprise level. Electric power companies can improve cybersecurity processes by helping to establish industry standards, exchanging threat intelligence with peers and testing new technologies.

“New tools are increasingly available and the capability to monitor networks in real time, discover threats and address them is advancing rapidly providing needed protection for the industry at large.”