The rapid pace of change and confusion caused by the COVID 19 epidemic seems to have super charged the cybercriminals that continue to plague us. 2020 has seen a tremendous rise in the number and sophistication of ransomware attacks across the board. Also, the number and sophistication of phishing attacks, notably targeting Office 365 users, have also increased of late. In addition, the recent very successful supply chain attacks that affected high-value SolarWinds users were incredibly well conceived, coordinated and executed. These attacks required great cyber skill, meticulous planning and manual interaction and monitoring by the attackers. They should be of particular interest to utilities, since utilities may face the same level of sophistication if attacked by nation-state level cybercriminals.

Since cybercriminals have upped their game significantly, it behooves utilities to up their game as well. They need to make it very difficult for cybercriminals to get a foothold on their systems in the first place, and if those efforts fail, they need to be able to detect, react and recover from attacks quickly and surely.

However, utilities are in a particularly bad position to implement adequate operational and technical security controls to properly secure these systems. For one thing, industrial controls systems and components used by utilities are long lived and generally were not designed with network security controls in mind. They are hard to retrofit, and so must be replaced with modern equipment or be secured with operational controls rather that technical controls. One fix means money and time for new equipment, the other fix means money and time for increased personnel.

Another problem is that, one way or another, many utilities can be attacked from remote locations over the Internet. To be efficient, centralization of control systems has increased, and inevitably it seems, industrial control networks are linked up at some point with administrative networks and the Internet. So, if your back-room network and the personnel who use it aren’t perfectly vigilant, they can be used as a vector for attackers to access the industrial control system. Also, industrial control devices can often be administered directly over web-based applications. This makes another vector for clever attackers to take advantage of.

In my opinion, the answer to fixing the utilities security problem does not lie solely or even primarily in technological fixes. I think the most effective way to resist modern cyberattack is through implementing operational controls and ensuring there are enough well-trained personnel to implement them. For example, all possible routes of access to industrial control systems need to be fully mapped and updated constantly. Any access from the administrative network or the Internet to industrial controls systems needs to be strictly white-listed and monitored. Administrative-level access controls should be fully implemented, and networks should be configured so as to make lateral movement across the network or elevation of privileges extremely difficult to accomplish. Dual controls should be implemented where appropriate, and utilities should consider using all three possible types of identification for particularly sensitive access to the system (i.e. remote administration and control of systems, adding and removing users).

Embrace the latest in information security guidance, what we like to call “best practices” level security. It’s difficult, frustrating and expensive, but nothing compared to what could happen in the event a sophisticated, coordinated and wide-spread attack on our utilities occurred.