Utility Week

18 | 17TH - 23RD NOVEMBER 2017 | UTILITY WEEK Operations & Assets Insight report N ot long ago it would have seemed like the preserve of a science fiction novel: a highly organised cyber attack on a country's critical infrastructure as part of an undeclared but de facto war. Yet just before Christmas 2015, this is what happened in Ukraine. Hackers man- aged to cause a blackout for nearly 250,000 customers of three energy distribution com- panies. The perpetrators' identities remain a mystery, but it is widely believed that the Kremlin was behind it. Of more pressing concern for the utili- ties sector, the Ukrainian blackout is also believed to be the first successful attempt to disrupt a power grid through a cyber attack. "That Ukrainian incident was a seri- ous wake-up call for the sector," confirms Talal Rajab, head of programmes, cyber and national security at Tech UK, a trade body for the technology industry. According to Rajab, the incident could be a sign of things to come: "It is state-level type of capability. Instead of sending tanks and soldiers on the ground, using something like this to bring a city down is the way wars could be waged in future." For utility companies, this demonstrates how they could find themselves on the front- line of this new threat. So, what are the specific threats to utili- ties and their customers? What has been done about it so far within the industry? And what more do companies, regulators and government need to do to keep us safe in an ever more connected and digitised operating environment? Part of the problem is that, when it comes to the kind of threats we are facing, there is not one simple answer. Attacks on the scale of the Ukrainian incident or the WannaCry ransomware attack that caused mayhem in the NHS in May this year (see box, right) may still be rare, but the severity of the con- sequences mean they have to be taken seri- ously. Meanwhile, the huge amount of data now being collected about customers' behav- iour opens up a whole other range of threats. "There are so many things that could happen," says Graeme Wright, chief techni- cal officer for the utilities sector at Fujitsu, which provides services to help protect busi- nesses against these types of attack. One area of concern for Wright is around demand response systems. "What happens with the information that Hive or Google or Amazon is collecting from consumers about how they're managing their energy use?" he asks. "And what happens if that information gets collected sufficiently to work out when people are in? How are retailers collecting and managing that data?" Wright's colleague, Jamie Wilkie, who works on Fujitsu's cyber security consult- ing portfolio, believes the potential threat from unsecured data is greater still. "At a Cyber security and utilities As recent high-profile cyber attacks have shown, cyber crime is a real and growing threat in our computerised world. Utility Week asks whether utilities are taking the threat seriously enough. system level, if someone can manipulate the demand response level of a whole city then the utility might believe there's a huge requirement for electricity where there is none, which could burn out the whole sys- tem," he explains. "A lot of renewables have demand response built into the system. If that gets hacked and someone sends constraint notices to all the turbines you suddenly have a brown out situation." Real and present danger These might sound like scare stories, but the threat is very real. A January 2016 report from Cambridge University's Centre for Risk Studies found that around 15 per cent of all cyber attacks logged in the UK were directed at the energy sector, making it second only to financial services as the most at-risk sector. The same report outlines the potential consequences of a cyber attack on the elec- tricity distribution network in the south and east of the UK. It estimates that this kind of attack could disrupt transportation, digital communications and water services for up to 13 million people and cost the UK economy between £49 billion and £442 billion. While the Cambridge report is necessar- ily speculative, the scenario it outlines is not outside the realms of possibility. Last month, EY ranked cyber attacks along with extreme weather events as the biggest operational The impact of cyber security on asset management Establishing a smart and connected asset base can offer utilities a vast array of benefits and efficiencies, but there is no denying that this field of innovation also threatens a minefield of potential security breaches. As the Internet of Things expands, compa- nies are likely to find their intelligent assets and SCADA systems increasingly integrated with enterprise IT systems, and the growing volume of consumer-grade technology used in business. This trend means a broadened attack surface for hackers and malware, and increases the scope for damage that a successful attack can cause. Graeme Wright, chief technical officer for the utilities sector at Fujitsu, says generators and network operators in particular must be alert to the dangers they expose themselves to as they increase their use of wireless technologies for smart asset management. "They use third parties, and engineers can plug in to update telemetry, so you've not got your own boundaries to manage," he tells Utility Week. But utilities should not be discouraged from pursuing a smart asset revolution. To gain the flexibility and efficiency benefits that a con- nected asset base can bring, they must ensure that technology deployments are accompanied by authoritative risk assessments and strate- gies for disaster recovery. The Energy Networks Association tells Utility Week that "joint collabo- ration is key". Network companies "regularly review" their cyber security policies to "ensure that the right measures are in place" to counter any potential threat, says a spokesperson.

• Cover