{"id":10749,"date":"2016-10-18T16:52:43","date_gmt":"2016-10-18T16:52:43","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2016\/10\/18\/emerging-focus-on-cyberthreats-to-energy-infrastructure\/"},"modified":"2026-08-08T04:32:42","modified_gmt":"2026-08-08T04:32:42","slug":"emerging-focus-on-cyberthreats-to-energy-infrastructure","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/management\/2016\/10\/18\/emerging-focus-on-cyberthreats-to-energy-infrastructure\/","title":{"rendered":"Emerging focus on cyberthreats to energy infrastructure"},"content":{"rendered":"\n

Last week, the Kentucky Office of Homeland Security hosted an exercise simulating attacks on the power grid and government computer networks. Participants included law enforcement, first responders, and private sector representatives engaged in health and security.\u00a0 The exercise centered on how the state would react if hackers were able to take down Kentucky’s energy grid while simultaneously engaged in the exfiltration of information from government computer networks. The goal was to provide a gap model and develop best practices that can be utilized by other states and by the federal Department of Homeland Security (DHS). Also last week, InfraGard of the National Capital Region announced a partnership between the FBI and the private sector to protect critical infrastructure and provide a comprehensive effort to recognize and support National Critical Infrastructure Security and Resilience Month. The initiative supports the DHS’ National Protection and Programs Directorate’s (NPPD) Office of Infrastructure Protection mission to raise awareness around critical infrastructure protection during the month of November. The energy sector has been a key area of attention for the NPPD.<\/p>\n\n\n\n\n\n

And perhaps the most concerning of news activity was the announcement by head of the United Nations nuclear watchdog, International Atomic Energy Agency Director Yukiya Amano, that a nuclear power plant in Germany was hit by a “disruptive” cyberattack within the past three years. Amano was quoted by Reuters as saying: “This issue of cyberattacks on nuclear-related facilities or activities should be taken very seriously. We never know if we know everything or if it\u2019s the tip of the\u00a0iceberg.” And he noted that this is ” not an imaginary risk<\/a>.”<\/p>\n\n\n\n

It should also be noted that in 2014, a computer in the control room at Monju\u00a0Nuclear Power Plant in Tsuruga, Japan, was subjected to malware, but possibly by accident. And in 2015, South Korean hackers targeted Korea Hydro and Nuclear Power Company, but luckily to no avail. Most cyber experts believe that North Korea was behind the attempted cyberattack. These incursions are a wake-up call as there is a very real and growing fear that a future cyberattack on a nuclear plant could risk a core meltdown.<\/p>\n\n\n\n

Non-nuclear power plants have also been subjected to intrusions and breaches. A hack in Ukraine was held up as a prime example. In December 2015, hackers breached the IT systems of the electricity distribution company Kyivoblenergo in Ukraine, causing a three-hour power outage.<\/p>\n\n\n\n

Refineries, dams and data centers are all potential targets of cyber incursion. According to a report released last month titled “The Road to Resilience: Managing and Financing Cyber Risks,” oil and gas companies around the world could face costs of up to $1.87 billion in cybersecurity spending by 2018.<\/p>\n\n\n\n

There have been attempted cyberattacks on grids and utilities, many via phishing and ransomware, and some have been successful. Adm. Mike Rodgers, head of the National Security Agency and U.S. Cyber Command, has stated that only two or three countries have the ability to launch a cyberattack that could shut down the entire U.S. power grid and other critical infrastructure.<\/p>\n\n\n\n\n\n

Much of our grid still relies on antiquated technologies, and more investment in defenses are needed. As technology exponentially advances and as threat actors (including cyber mercenaries) gain tools via the dark web, that number of potential state-sponsored adversaries could expand in the near future.<\/p>\n\n\n\n

In 2013, President Barack Obama issued Executive Order 13636, “Improving Critical Infrastructure Cyber-security,” which called for the establishment of a voluntary risk-based cybersecurity framework between the private and public sectors.<\/p>\n\n\n\n

Rep.\u00a0<\/a><\/p>\n\n\n\n

Trent Franks<\/a><\/p>\n\n\n\n

, R-Ariz., chairman of the congressional EMP Caucus, and considered the foremost expert in Congress on electromagnetic pulses,<\/p>\n\n\n\n

has introduced\u00a0legislation ( HR 3410<\/a>) called the Critical Infrastructure Protection Act. The law would enable DHS to implement practical steps to protect the electric grid by training and mobilizing first responders for possible EMP events.<\/p>\n\n\n\n

Along with Franks and Peter Prye, who heads the Task Force on National and Homeland Security (a congressional advisory board),\u00a0several noted industry and policy experts, including former CIA Director Jim Woolsey; Frank Gaffney, former deputy secretary of defense and president and CEO of the Center for Security Policy; and Michael Del Rosso, former chairman of IEEE-USA Critical Infrastructure Protection Committee have been especially active in alerting the public to the critical need to find near-term solutions to protect the grid.<\/p>\n\n\n\n

Clearly the entire energy critical infrastructure is justified in garnering the attention of DHS, states, regulatory organizations and the many subject-matter experts on the topic of cybersecurity.<\/p>\n\n\n\n

While the threats are complex and the threat actors varied among hackers, state sponsors, organized criminal enterprises and terrorists, there are several themes to adhere to mitigate risk. These include:<\/p>\n\n\n\n