As promised in our introductory piece on threat detection strategies by industry, we are now taking a deeper look at the energy industry and how system operators can adequately protect themselves against threats.
Threats have significantly evolved over time as well as the strategies used for detecting those threats. In the early days of malware, the motivation of the malware writer was often publicly known, either in order to make a name for themselves or to prove that they were clever enough to subvert any existing security measures. Today, the creation of malware is a highly profitable business and the motivations behind cyber-attacks are often for financial gain or the destruction of assets. This is partly due to the migration of many assets and information to online environments. The introduction of technology and network access in many areas has offered plenty of cost savings and opportunities while also enabling cyber attackers to use different attack vectors when they pinpoint their targets. With the introduction of new technologies and the possibility of cyber-attacks, companies need to be prepared by investing in adequate protection. This is especially true for the energy industry, as there are specific threats that operators need to be aware of and make sure their security policies protect against.
Like most organizations, companies in the energy industry have made many changes to their operations as a result of new technology that is now available. Production and distribution of energy can now be digitally monitored with much greater accuracy and efficiency than in the past because there are very accurate sensors that can automatically transmit information to central monitoring locations. Better sensors have also improved safety and reduced the likelihood of major accidents. It is now much easier to quickly alert the necessary people when problems arise or even fix those problems automatically without requiring human intervention. Automation has improved the efficiency of many systems, which has cut the costs associated with misdirected or misallocated energy.
Although there are many benefits, there is also an element of risk introduced when analog systems are replaced with digital systems. The same interfaces and software that make digital sensors and monitoring systems so useful also provide a way for cyber criminals to attack and subvert the system. This impending danger is amplified in the energy industry because so many of the systems in question are critical parts of national infrastructure, so an attack on these systems could have potentially disastrous effects. For example, if someone were able to hack the sensors to send incorrect data to the monitoring systems, this could result in physical systems becoming overloaded and damaged, which could bring down distribution networks such as oil pipelines or electrical grids. If sensors or control systems at nuclear facilities are compromised, there is the potential for reactions and meltdowns that would render the entire plant inoperable. If hydroelectric dams mistakenly released too much water, the result could be massive flooding and loss of property. The risk of physical, financial, and psychological damage makes it more important that critical infrastructure be secured against the threat of digital attacks.
Since the potential damage to these systems is so great, there is a heightened incentive for potential attackers to target the energy industry. Although the industry faces the same concerns of others around the loss of data or intellectual property, such as the data-stealing Trojan.Laziok malware (See Metascan Online scan results), the nature of the industry makes attacks from those seeking to cause destruction a much bigger cause for concern. Energy sites, along with other critical infrastructure, are prime targets for terrorist organizations and hostile governments that seek to cause widespread damage. These organizations often have significant resources at their disposal, such as the Dragonfly Hacking Group (See Metascan Online scan results), so that they can develop technically advanced malware that is specifically designed to target a specific company or system. This malware can be designed with a company's specific systems in mind, as well as be designed to exploit specific individuals who work at the company. When designed with these specifications, malware can successfully compromise even the smallest gaps in an organization's digital defenses and remain undetected inside the organization for long periods of time. The BlackEnergy malware (See Metascan Online scan results), which targeted critical infrastructure, was found to have already infected multiple systems by the time it was detected.
To protect themselves against these types of attacks, organizations have to take a sophisticated approach to threat prevention. A single layer of defense is not an adequate level of protection since custom designed malware will be developed to subvert that defense. A policy of multiple protection methods should be applied at several layers. For the detection of viruses, it is advisable to use a multi-scanning product that combines the power of multiple antivirus engines. In addition to multi-scanning, threat prevention methods such as file type filtering and data sanitization should also be utilized. Finally, in addition to the technological steps to prevent threats, employees should be fully trained on the appropriate processes and procedures for handling data that may contain threats to the organization's secure systems and networks.
Although this multi-layered defense is the best way to prevent digital threats, organizations also need to make sure they have a plan in place to deal with security breaches if they happen to occur. The potential negative impacts are too critical and the opponents have too many resources at their disposal for those in the energy industry not take every precaution to prevent and plan for potential attacks on their systems.
The third post in this series, Effective Threat Detection Strategies for the Financial Industry, is now available on our blog.
