Someone or some group is attacking the US electrical power grid. Specifically in the Seattle, WA area which comes after a series of similar incidents elsewhere in the Pacific Northwest as well as in Florida. And law enforcement has never caught the guy who attacked the electrical grid down in North Carolina earlier in December 2022. These were physical attacks which involved alleged shooting up power substation.[1] As evident, these are physical attacks, not even cyber-attacks.
Shooting with high power rifles and high grain ammunition can do damage to a substation and knock out power to thousands. The attached is a picture of where someone can ride a bike right up to high tension wires. A small explosive could damage a tower and theoretically cut power to ‘hundreds’ of thousands. Physical security prevention measures can thwart these type attacks, but let’s get back to cyber-attacks on the electric grid, which operate on ICS/OT systems.
What magnitude of cyber-attacks can we expect to see on critical infrastructure in 2023? To gain a better understanding, the Global Director of Cyber Ecosystem at Hexagon Asset Lifecycle Intelligence (HALI) provided a picture for 2023.
The Industrial control systems/ Operational technology (ICS/OT) Skills Gap will Widen Due to Unprecedented Demand - According to HALI: “Research has shown that the vast majority of electricity, oil and gas, and manufacturing firms have experienced cyberattacks over the past year and a half or so. Research has also shown that the cybersecurity workforce gap is growing due to high demand for skilled professionals. In addition to the intense threats against critical infrastructure systems that’s been prevalent for years, the Biden Administration’s new 100-day sprints across sectors and more regulations are released, more specialized professionals are needed to keep up.[2] Additionally, many organizations currently lack staff with the ability to successfully integrate security practices and rigor across IT and OT departments, which is gaining significance and importance with the rise of industry 4.0 in 2023.”
Industry 4.0 Will Drive the renewed IT/OT Convergence Conversation - On this business reconfiguration, HALI explains: “Collaboration of IT and OT departments will continue to be the best solution for remediating vulnerabilities, tracking present and future threats, and responding to any incidents efficiently. However, the conversation will continue to be heated and overshadow the benefits of merging the security oversight and accountability of these two historically separated departments. IT-OT convergence is not a new idea. It has been around for decades and the most successful companies have reaped the benefits.” Further to corporate changes, HALI opines: “The difference now is with the rise of Industry 4.0 and the interconnectedness of systems we’re seeing, collaboration between these two departments is no longer an option but a necessity. We anticipate we’ll see many major companies jumping aboard the converged security ship and observing the benefits from increased efficiencies and visibility to decreased costs and downtime.”
Attacks on ICS/OT Will Result in Human Costs - In terms of the impact of these types of changes, HALI sets out: “We all know that attacks on critical infrastructure have real-world implications. Whether it’s contaminated water supplies or minimal access to fuel, we’ve seen the costs these cyberattacks have firsthand. While hackers’ activities will likely still be money-driven, we can expect to see human cost become more of a play in the following year. Asset visibility continues to be an issue for operators, which means securing, segmenting and hardening defenses becomes a guessing game of what’s important and what’s not. If IT and OT security convergence continues to be stunted and, thus, visibility remains poor, attacks that have been close calls in the past (such as the poisoning of the water supply from a Florida plant in 2021 and the vulnerability of the electric grid) will eventually have human costs.” The power goes out, the weak suffer the most.
We’ll See a Catastrophic Attack on the Energy Grid in 2023 - For the US HALI is particularly worried about the impact upon utilities. HALI predicts: “The skills gap, recession and tensions abroad are forming a perfect storm for a major attack on the power grid in 2023. Energy experts sounded the alarm in June of 2022 that the electric grid in the US wouldn’t be able to withstand the impacts of climate change, and as Ukraine stands its ground in its conflict with Russia, we’re likely to not only see more attacks on Ukrainian energy infrastructure, but the US’s infrastructure as well.” As part of this trend, HALI adds: “At the beginning of 2022, Homeland Security warned that domestic extremists had been developing plans to attack the US electric power infrastructure for years. The combination of aforementioned factors makes the US’s power grid more vulnerable to cyberattacks than it has been in a long time.”
Buy a generator.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. For questions, comments or assistance, please contact the office directly at 1-844-492-7225, or feedback@wapacklabs.com
Weekly Cyber Intelligence Briefings:
- Reporting: https://www. redskyalliance. org/
- Website: https://www. wapacklabs. com/
- LinkedIn: https://www. linkedin. com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/5504229295967742989
[1] https://www.nationalreview.com/the-morning-jolt/whos-attacking-our-power-grid/
[2] https://www.digitaljournal.com/tech-science/us-warned-over-critical-utility-cyberattack-in-2023/article
Comments