It isn’t news that the energy industry faces rising cybersecurity threats. However, the penetration methods and attempts can still surprise. Attackers are looking to exploit weakness wherever possible, using techniques such as spear-phishing campaigns and targeting devices like laptops or thumb drives. Steps need to be taken to mitigate and protect utilities and their customers.
"Transient electronic devices" is the phrase of the day from a series of recent articles about the bulk power system regulatory body NERC (North American Electric Reliability Corp). In a Utility Dive article, FERC Moves to Shore Up Potential Cyber Vulnerabilities, Robert Walton highlights approved revisioning and heightened cybersecurity rules to “help shore up…defenses.”
At the order of the Federal Energy Regulatory Commission (FERC), NERC has issued an order providing guidance to help further protect air-gapped systems. NERC has taken an interest in thumb drives, laptop computers and other portable devices. They are especially interested in devices that are "connected to and disconnected from systems."
This comes out after a series of warnings about likely campaigns believed to be targeting critical US energy infrastructure. The US-CERT put out a warning based on Department of Homeland Security (DHS) and Federal Bureau of Investigation (FBI) analysis. They caution that Russian state-sponsored cyberattacks are actively targeting the US government, energy, nuclear, water, aviation, critical manufacturing, and commercial facilities.
Adding air-gapped mitigations to critical infrastructure is an important part of a cyber program and is highly recommended. It seems this order may not be addressing the real problem given that the attacks being publicly discussed in the past year were largely the result of spear-phishing campaigns.
Read the full article FERC Moves to Shore Up Potential Cyber Vulnerabilities.
To learn more about how Landis+Gyr uses advanced security to Stop the Next Breach with Non-Proprietary, Standards-Based Solutions.