Why Does Cybersecurity in the Energy Sector Matter?

Energy companies must take into account the risks at the level of:

• IT systems - all systems that keep the business running, as well as the database management software.
• OT infrastructure - including hardware and software related to the production, storage, and sale of energy, using cloud and industrial IoT solutions.

It can already be seen here that securing the vast energy supply chain is quite a challenge.

That is why one common protection method is using cloud infrastructure with strict access controls to disperse the data crucial for the company's operation. Put simply, keeping your vital data away from the company's end-user and hardware makes it more secure.

Cloud computing in the energy sector

Thanks to the use of the cloud, the processes of energy companies can be:

• flexible,
• scalable,
• available on demand.

And yet, due to their long tradition and relatively slow evolution, many energy companies are reluctant to digitize.

However, in a 2020 survey, 81% of those that had transformed admitted they could innovate faster with the public cloud than with on-premise solutions (report here). That matters given the energy industry's rush to meet society's expectations and legal requirements regarding sustainability. People are increasingly aware of the importance of going green, which imposes certain obligations on the entire business.

Without proper care for security, energy companies will disappoint their customers and will also find it even harder to switch to the green side of the force.

Fortunately, RES companies are well aware of the importance of maintaining the security of critical systems. Most of them were created recently, in a tradition where such things were a matter of course. But that doesn't yet apply to the entire industry.

Colonial Pipeline compromised

In May 2021, a group of hackers completely blocked the operation of Colonial Pipeline's IT systems. It is the largest refined oil pipeline system in the US and can carry up to 3 million barrels of fuel a day.

As a result, the East Coast had to do without 45% of its fuel for six days. In addition, consumers panicked as gas prices jumped the most in over six years.

That is why the IT world has to work together to ensure that our crucial energy supply chains are safe and sound, and help them evolve (or rather revolve) into more sustainable ones.

In the energy industry, large physical installations are monitored and optimized through software. This convergence places additional requirements and challenges on the decision-makers in the business.

Thanks to the adoption of cloud and machine learning technologies, an energy company can:

• better manage the maintenance - to accurately plan repairs, service works, and power outages,
• save resources and reduce costs - by ensuring optimal operation of the supply chain,
• cushion the effects of sudden events - by managing the inventory.

This alone shows how much there is to manage in the energy sector, so let's dwell on that for a while.

Just how BIG is the physical?

Some power plants and supply chains are so gigantic that any cloud that holds all the processes to manage them has to be gargantuan! That's one of the reasons why the cloud security market in the energy industry was predicted (report here) to register a CAGR (Compound Annual Growth Rate) of 11.2% in 2021–2026.

To grasp the scale: the Three Gorges Dam hydroelectric power plant is the largest power plant ever built, with an installed capacity of 22,500 MW. That is twice as much as Germany's total hydroelectric power.

If we look at it this way, all the processes and systems that manage such a large structure must be designed and maintained with great care.

The more extensive the network of dependencies, the harder it is to take care of it, and therefore the greater the susceptibility to malicious attacks.

What are the three reasons for the particular concern we should have for the energy industry?

1. Nation-state adversaries and money-hungry cybercriminals may benefit from sabotaging the energy supply chain - for them, it's simply worth it.
2. Installations have a huge potential attack surface - both physical and cyber - making the whole network easy to access.
3. The energy industry relies on many third-party actors in power transmission and sales - by threatening them, the attackers may put the entire supply chain and production on hold.

What is the Order Group approach to ensuring the security of energy sector businesses?

It is best to start taking care of security from the design phase (or from the beginning of digitization if we deal with an energy company operating for a long time).

In cooperation with the Norwegian start-up KYOTO, whose idea was to provide efficient solar energy based on CSP technology, we designed the entire system to manage energy production, storage, and sales. We studied the subject in depth, which allowed us to ensure the security of the solution from the very beginning.

The energy industry must be immune to social unrest or hostile takeover attempts. Fortunately, by ensuring cybersecurity, you can minimize threats.