Over the past few decades, cyber security has become a serious concern of banks and large commercial corporations. Many of these corporations have seen large scale breaches that have affected millions of consumers worldwide. Some of these breaches have had long lasting negative effects on the customers and the core business models.

But what about the energy sector? There are considerable numbers of power and energy meters, protective relays, switches and controls in power plants and substations. These devices are used to report on power flow, protect electrical feeders and provide safety controls to apparatus. Many of these were designed years ago, and as such have only basic password protection that could be vulnerable to cyber-attacks causing outages, interrupting service, or even worse, inflicting permanent damage to the power distribution. In October of 2017, the U.S government issued a rare public warning that sophisticated hackers were targeting energy and industrial firms – the latest sign that cyber-attacks present an increasing threat to the power industry and other public infrastructure.

In the 2015 Global State of Information Security Survey, it was reported that power companies and utilities around the world saw a six fold increase in the number of detected cyber incidents over the previous year. That year, there were a total of 46 incidents reported in the energy sector, accounting for 16% of the incidents among all sectors in the US, alone. More recently, energy and electric utilities have suffered an increase in cyber-attacks according to a survey by Tripwire, a digital security firm. Over 75% percent of the 150 information technology personnel surveyed in the oil, natural gas and electricity sectors had experienced at least one successful cyber-attack within the previous 12 months. These attacks consisted of an attacker successfully infiltrating a firewall, anti-virus program or other protections at the utility. Almost half of those surveyed had seen an increase in attacks over the previous year, and more than 80% percent expected an attack that would harm physical infrastructure, that year.

Cyber-attackers are no longer motivated solely by monetary gain. Their primary motivation is cyber-warfare. Cyber-warfare is a computer or network based conflict involving attacks by one nation against another in an attempt to disrupt the activities of organizations. These attackers or hackers are becoming the 21st century soldiers. Infiltrating a power grid would allow them to disrupt a nation’s economy, distract from a simultaneous military attack or create national trauma. Moreover, since power equipment often take long period of time to rebuild, this could have lasting effects on consumers concerning power reliability. Compromising safety controls in power distribution equipment could not only cause dangerous catastrophic failures, but may also leave the energy provider with few options to restore reliable energy flow.

Some hackers’ maliciousness is intended for recognition and respect within the hacking community: the bigger the intrusion and disruption, the greater the recognition from their peers. With this increase in black hat hackers looking for personal gain and recognition, and growth in cyber-attacks on utilities, significantly greater measures need to be undertaken within the energy sector to better secure power grids worldwide. Utility and industrial companies fight cyber-attacks with firewalls, data loss prevention (DLP) systems and Intrusion Prevention and Detection systems (IPS/IDS), but what about the power and energy meters in your facility or in the field at utility substations?

•   Changing the configuration of a power meter could also cause a circuit to look like it is out when power is actually flowing. This could trigger false control schemes and automatic restoration attempts. These false conditions could have catastrophic effects on power system equipment, making quick restoration very difficult. Moreover, attacks like this would provide dangerous working conditions for utility line restoration and maintenance employees.

•   Results from these attacks could result in financial loss, and even the loss of human life – for example, if a hospital were to lose their main and backup power systems. These attacks could also result in sanctions or fines from governmental regulators.

•   Relying on only one source of communicating data, such as mere relay data or power meter data alone, invites undetected attacks, especially without cybersecurity integrated into the equipment. Power meters’ and other power system sensing equipment’s identification data should be confirmed as matching before any control schemes are initiated.

•   Country espionage can occur through theft of the energy data of private facilities, such as military installations or data server farms, by determining what they may be producing or cooling.

2.  Training on Social Engineering Attacks – Social Engineering hacking occurs when the one weakness in an organization can be exploited, that is, human psychology. By utilizing social media, phone calls, emails and human interaction, attackers will often trick workers into giving them access to sensitive information. Frequent training is required to educate workers to look out for these attempts to gain access to a company’s network or hardware.

3.  Digital Signatures for Firmware Verification– When firmware is uploaded to a power meter or any other technological device, it should be signed and verified. This means that the specific device leaves the factory with its own signature, and any subsequent firmware updates for the device must have the correct matching signature for the device to allow it to be uploaded.

4. Limitation of Access – Hardware and software security should offer role based access. This allows the administrator to limit access to what the user can view, edit, reset, download, etc., by setting up roles with those restrictions and assigning the user to the appropriate role.

5. Better Requirements for Passwords – It takes an attacker 4 minutes to hack into an account with a 4 character password. A password of 30 characters would take 4 nonillion years (that’s 32 zeros). Better password requirements and increased frequency of password changing will greatly increase an organization’s protection.