As utilities increasingly adopt business models that connect
OT power generation, transmission, and distribution assets to Information Technology
(IT) systems, critical infrastructure is more vulnerable to cyber attacks
according to the study. The survey
results show the risk of cyber attacks on the utility industry may be worsening
with 56 percent of respondents reporting at least one shutdown or operational
data loss per year, and 25 percent impacted by mega attacks, which are
frequently aided with expertise developed by nation-state actors. The
vulnerability of critical infrastructure to cyber attacks has potential to
cause severe financial, environmental and infrastructure damage, and according
to all respondents, 64 percent say sophisticated attacks are a top challenge
and 54 percent expect an attack on critical infrastructure in the next 12
months.
“Increasing electrification across a range of sectors is a
crucial piece in the decarbonization puzzle, but, as the Siemens and Ponemon Institute report
documents, an increase in grid-connected infrastructure creates additional
vulnerabilities to cyber attacks. A devastating attack would not only harm the
economy, but it could also slow down the rate of electrification. This report
provides recommendations to help utilities better address these risks. Getting
this right is not only important for the security of our electricity system,
but also for achieving our climate goals,” said Randy Bell, Director of the
Atlantic Council Global Energy Center.
Most surveyed global utilities say that cyber threats present
a greater risk to critical infrastructure - compared to IT systems – and are
concerned with unique industry challenges, including ensuring availability,
reliability and safety of electricity delivery. Industry-wide, readiness to
address cyber attacks is uneven and has common blind spots, especially with
regards to the unique cybersecurity requirements for OT, and the importance of
distinguishing between security for OT and security for IT. This remains a
major challenge for many organizations across the industry. Only 42 percent
rated their cyber readiness as high, and only 31 percent rated readiness to
respond to or contain a breach as high.
Caught in the Crosshairs: Are Utilities keeping up with
the Industrial Cyber Threat? follows two previous collaboration between
Siemens and the Ponemon Institute, including Assessing the Cyber Readiness
of the Middle East’s Oil and Gas Sector and The State of Cybersecurity
in the Oil &Gas Industry: United States.