POWER March 2016 - 34

CYBERSECURITY
Beyond the Firewall: Best
Practices for Cybersecurity Risk
Management
Good power industry cybersecurity risk management goes far beyond stopping
intrusions. Preparing for when-not if-your operation comes under
cyberattack means anticipating the potential damage to your company's
finances, reputation, and regulatory compliance. Here's what the bestpositioned
power generators are doing to stay ahead of the risks.
Thomas W. Overton, JD
G
enerating companies wondering if
concerns about cybersecurity are
overblown got some rude wake-up
calls this winter.
The first call came when Ukrainian media
reported that a December 23 blackout that
left more than a million people in the IvanoFrankivsk
region in Ukraine without electricity
for several hours was the result of a
deliberate cyberattack perpetrated by a group
based in Russia.
In a report on the incident published in
January, security firm ESET confirmed that
the attack on several Ukrainian electrical
distribution companies was carried out using
the well-known BlackEnergy malware
family, which has been used in cyberattacks
for nearly a decade. According to ESET,
systems previously infected with the BlackEnergy
backdoor were injected with a trojan
known as KillDisk, which is capable of
making infected computers unbootable. (In
computer security, a backdoor is a means
of bypassing normal authentication, while
a trojan is malware that appears to be a legitimate
file. A trojan can install or function
as a backdoor, while a backdoor may exist
for a variety of benign or malign reasons,
including being placed there by the original
programmer.)
In this case, the KillDisk component also
contained " additional functionality specifically
intended to sabotage industrial [control]
systems " (ICSs). ESET said the systems
were likely infected using simple spearphishing
email techniques, where the malware is
contained in an attachment. The KillDisk
component contained commands that would
shut down and overwrite several key ICS processes.
The
company noted that the KillDisk element
was only part of the intrusion.
34
" The BlackEnergy backdoor, as well as
a recently discovered SSH backdoor, themselves
provide attackers with remote access
to infected systems. After having successfully
infiltrated a critical system with either
of these trojans, an attacker would, again
theoretically, be perfectly capable of shutting
it down. In such case, the planted KillDisk
destructive trojan would act as a means of
different entity, the Israel Electric Corp.), operations
were severely disrupted. The source
of the attack was not stated, but previous cyberattacks
on Israeli government sites have
been blamed on Iran or the militant group
Hezbollah.
The risk of attack is clearly growing
fast. An October 2015 study by PricewaterhouseCoopers
of cybersecurity incidents
An October 2015 study by PricewaterhouseCoopers
of cybersecurity incidents
found that the number of cyberattacks in
the power and utility sector attributable
to organized crime doubled in 2015.
making recovery more difficult. "
Other experts believe that the Ukraine outage
was in fact the result of intentional sabotage
by the hackers after they took control of
the system.
Then, on January 26, the Israel Electric
Authority reported that it had come under a
" very serious " cyberattack that caused much
of its network to malfunction and multiple
computers to be shut down. The attack took
the form of " ransomware, " a type of malware
used by criminals to lock down a computer
system until a ransom is paid, and was also
the result of a successful email phishing attack.
Although the attack itself did not affect
the country's electric grid (which is run by a
www.powermag.com
found that the number of cyberattacks in the
power and utility sector attributable to organized
crime doubled in 2015, and the financial
losses as a result of all incidents in the
sector increased 95% year-over-year.
Know Your Risks
While the worst-case scenario of losing control
of a power plant or grid management system
and having malicious actors shut things
down-as occurred in Ukraine-may be
obvious, the potential risks from a successful
cyberattack on a generating company or
distribution utility extend far beyond that.
Regulatory Risks. There are increasing
regulatory risks, as governments implement
POWER | March 2016
http://www.powermag.com
POWER March 2016

Table of Contents for the Digital Edition of POWER March 2016
