Utility Week

14 | JUNE 2022 | UTILITY WEEK Energy backed up by the interviews. With govern- ment warnings of cyber-attacks being issued to critical infrastructure organisations as ten- sions with Russia began to escalate, this risk was clearly front of mind. One network's digital director said: "Hardware and so• ware is the big security risk. And the range of risk is enormous; we hold lots of customer data and we wouldn't want to lose that. Hacking into data could see the lock down of our system and make it di• cult to operate. That's the biggest fear – a lockdown of our systems and that we end up losing visibility." Interviewees said that utilities were prone to the type of ransomware attacks that cor- porates across the board were being sub- jected to, with breaches in some cases being triggered just by clicking on a rogue email. Clearly, for utilities the impact was height- ened because energy and water companies provide essential services to customers. It was felt that breaches of cybersecurity would only continue to grow as a risk fac- tor as operations became more digital, and a large number of digital devices (like sen- sors) were added to networks. The director of a gas network commented: "I think it is becoming increasingly important that any of these digital interfaces with your assets is one thing to scrutinise. Another thing is the consequences of losing supply and the reli- ance that there is on digital solutions, both in terms of communication and in getting the system back up and running. That's some- thing we're having to think about as well." A retailer concurred: "We're ultimately building a system in the future that is more exposed to cyber breaches because of coordi- nating activities on the demand side. There's lots of new routes in that we don't have con- trol over that can ultimately result in attack on the electrical network." A section head at a water company ech- oed these sentiments. "Breaches of cyber- security is at the very top of our risk list. And really this is down to the growth of and accessibility of sensors and IoT [Internet of Things] devices, which we desperately need for our business to boost visibility of how well our operations are functioning. "But what we're seeing is that the sensor companies all have their own platform held Analysis continued from previous page 5 A major new Utility Week insight report in association with Marsh How water and energy companies view the impacts of environmental, societal, technological and political trends on their businesses UK UK UTILITIES UTILITIES UTILITIES RISK RISK RISK RISK RISK RISK RISK RISK RISK REPORT REPORT Download the report Download the report UK Utilities Risk Report: How water and energy companies view the impacts of environmental, societal, technological and political trends on their businesses free at: https://utilityweek.co.uk/uk-utilities-risk-report/ in their own cloud. It ends up so that your data is scattered everywhere. And unless you have really, really careful governance around you, and have a strategy on how you're going to manage all of this, it could get very messy, and especially at the innovation end, when trying new things. "We have a very active cybersecurity department; we have the right. governance controls over what we're doing and there is a high chance of us mostly being able to man- age that risk. But it needs investment and resource to give it the proper due diligence and to keep pace with the speed of change." Turning to energy retail, six out ten (63%) viewed a serious cybersecurity breach as a high-risk factor, and the same number said it would have a serious impact on their busi- ness. The threat here was around informa- tion being stolen. One retailer said they were surprised that the risk was not scored more highly, particularly with the rollout of smart meters, which although governed by strin- gent security controls could still potentially provide another entry into the network. However, one interviewee from retail pro- vided a di' erent viewpoint. They thought it was surprising that the impact had been rated so highly, particularly where impact on the business was concerned. "I can understand why the issue of cyber- security is both high risk and high impact for energy infrastructure, because it would have a material impact, or you can have a malicious actor that's trying to shut down parts to the grid that would cause absolute chaos. But for a retailer, the obvious security risks are a bit di' erent, because really, we're thinking about a loss of personal data. "But even in that scenario where there has been a cyber breach and some customer data, which, frankly, is the most valuable data that we hold, has been breached, pri- marily it's more of reputational risk, and it's a question of how your customers then react to the fact that you are not careful enough with their data. "I think it's as signi" cant as some of the other risks that a retailer is facing. But for me, much more fundamental and the con- cern I would put " rst, is whether customers can a' ord to pay their bills or not." Regulation and cybersecurity Concern was voiced that the regulatory bur- den around cybersecurity was unhelpful and unnecessarily bureaucratic, and so too the regulatory culture. The digital director of a network set out what they saw as the problem: "Regulators tend to take a punitive approach based on " nes and penalties.

• Cover