Operational Technology Cybersecurity for Energy Systems

NIST defines confidentiality as "preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information."

The confidentiality principle of the CIA triad is what protects the privacy of potentially sensitive data. While this commonly includes encryption (which is a powerful technique) other tactics include strong methods for access control, authorization, and authentication.

NIST defines integrity as "Guarding against improper information modification or destruction and includes ensuring information non-repudiation and authenticity."

Maintaining integrity means ensuring that information is valid and hasn't been altered by anyone on its way to the destination. For example, this can be done by generating a unique identifier for a file and verifying that the identifier is the same when re-generating upon receiving a file.

NIST defines availability as "Ensuring timely and reliable access to and use of information." The availability principle of the CIA triad strictly focuses on ensuring systems are functioning properly when they need to. In the case of energy systems, this means keeping the lights on. In other industries, this might be more associated with data availability, or another service such as entertainment.

Supply chain risk is defined by NIST as "the risk that an adversary may sabotage, maliciously introduce unwanted function, or otherwise subvert the design, integrity, manufacturing, production, distribution, installation, operation, or maintenance of an item of supply or a system so as to surveil, deny, disrupt, or otherwise degrade the function, use, or operation of a system."

Oftentimes this is a risk that slips under the radar but can cause significant issues. Downstream supply chain risk can put a site at risk for serious privacy concerns, risk of disruption to availability, as well as the potential for hardware/software vulnerabilities that are not publicly documented.

According to NIST, a vulnerability is a "weakness in an information system, system security procedures, internal controls, or implementation that could be exploited or triggered by a threat source."

Common sources of vulnerabilities across OT within energy systems include but are not limited to:

• Sensors, controls, and communications: Cyber-physical convergence of IT/OT can constitute a new attack surface.
• Power electronics: Enhanced performance capabilities but with hardware that may have vulnerabilities.
• Connectivity: Energy efficiency and renewable energy technologies are increasingly internet- and grid-connected, allowing for new opportunities at the cost of increased attack surface.
• Legacy systems: Lack basic cyber defenses. The age of a legacy system can make it impossible to update or change.
• Internet and grid connections: Due to the cyber physical nature of energy systems, there is an enhanced motive for attackers to have a direct impact on components in the real world.

Physical harm and monetary losses are common consequences due to "availability" being an attractive target to attackers. Cyberattacks can cause physical damage to equipment. For example, running machines at different speeds can result in mechanical damage including immediate damage, increased wear and tear over time, or even harm to people nearby.

Due to cost and complexity, equipment in the energy sectors is replaced less often than consumer products such as computers and phones. Physical damage requiring serious repairs or even replacement is a major impact to organizations or federal facilities—and tends to be very expensive.

According to NIST, eavesdropping is an "attack in which an attacker listens passively to the authentication protocol to capture information that can be used in a subsequent active attack to masquerade as the claimant." Eavesdropping can pose a threat to control systems in that an attacker can gain access to commands, set points, and other sensitive information relevant to cyber physical systems, which may aid them in carrying out a more elaborate attack.

While it is not a complex tactic, the modification of data, settings, or default setpoints can have a disastrous outcome in OT environments. The physical nature of OT cyber systems leaves them susceptible to integrity attacks such as false data injection or the malicious modification of settings that may remove preconfigured safety settings. This, in turn, could cause machinery to operate at conditions outside of a safe threshold thus endangering equipment and personnel.

NIST defines denial of service as "the prevention of authorized access to resources or the delaying of time-critical operations." Often, this is the result of sending copious amounts of traffic to a server and rendering it incapable of responding to legitimate requests by operational equipment. Traffic originating from many different sources is known as a distributed denial of service, or DDoS, attack, making it very difficult to trace. This can very quickly compromise the availability of energy and electricity to a population.

Note that many tactics and techniques can be used in conjunction with each other. For a helpful reference on tactics and techniques used in cyberattacks on industrial control systems, visit MITRE ATT&CK for Industrial Control Systems.

The following are examples of real-world and research scenarios indicating potential weaknesses in energy systems and facilities.

Wind Turbine Hack

A 2017 Wired.com article titled "Researchers Found They Could Hack Entire Wind Farms" demonstrated how easy it can be to take control over a wind farm if the proper physical and cyber precautions aren't taken. Utilizing a Raspberry Pi, an attacker was able to intercept messages headed to the turbine controller and stop the turbine from turning. This is just one example. Penetration tests can provide a shocking look at how vulnerable a component or collection of components can be and highlight potential outcomes should a real attacker gain access. Allowing the control of OT to fall into the wrong hands can result in extreme consequences including damage or destruction to components.

Building Automation System Hack

An attack on a building automation system (BAS) in Finland rendered heating systems completely inoperable due to a denial of service attack. For several days, computer systems attempted to reboot themselves which only prolonged the outages. A combination of lack of awareness/training and poor Internet of Things configuration created an opportunity for attackers to take advantage of the situation.

While not comprehensive, the above examples provide context for the variety of attacks on OT systems and their potential effects if risks are not appropriately addressed.

Access control authenticates and authorizes individuals to access information. For example, if a facility has a BAS, good cyber hygiene could limit access to building data to only those users who need that information to conduct their job duties—and they would only see the specific information necessary for their role ("least privilege"). When users no longer need to access specific building data, their access would be removed. Administrators would also ensure that passwords to access the BAS data are quickly changed from defaults, are regularly changed, and are unique to each user of the system.

Patch management helps identify, install, and verify patches for products and systems that address potential security vulnerabilities or other issues. While it may be difficult to implement an automatic update routine for older OT systems, it is extremely important to update software and firmware when possible, as running old code can leave a system very easily exploitable.

For small and large organizations, maintaining an effective and consistent asset management policy facilitates visibility into the environment and helps ensure that devices can be accounted for. Sites should have a regularly updated inventory of devices that includes OT systems such as meters, gateways, remote terminal units, and other components.

This inventory will serve as a helpful reference during normal operation as well as during a potential cybersecurity incident. Additionally, maintaining an up-to-date network configuration diagram provides detailed context for maintenance, system changes, or response/recovery in the event of an attack. This includes any connections from OT systems to the IT or enterprise network.

Hardening is the process of eliminating a means of attack by addressing vulnerabilities and turning off non-essential services. The separation between the IT and OT network is critical to reducing the potential attack surface to OT. Phishing is one of the most common attacker entry points into an IT environment but is still a serious threat to OT. Lack of separation of networks may provide an opportunity if an attacker obtains credentials though a successful phishing campaign. It is important to remove outside "rogue" connections/circuits and close unused ports—for example, disabling functionality of a webserver on a device that does not require it. This simple step can remove an opportunity for attackers to have unauthorized access to a device that was simply poorly configured.

In the event of a cybersecurity incident, a quick and effective response plan is essential to preventing a bad situation from becoming catastrophic. Planning and proper documentation are two critical aspects of developing an appropriate cybersecurity response and recovery plan. This includes identifying and assigning responsibilities, sharing information, and reviewing and updating as changes to the environment occur. The NIST Guide for Cybersecurity Event Recovery provides detailed information for understanding the cybersecurity recovery process.

Due to the reliance on third-party vendors for hardware and software for energy delivery systems, it is important to consider cybersecurity from a contractual language perspective. This includes but is not limited to supplier software requirements, suggestions for documentation, and addressing cybersecurity lifecycle issues. For more information on cybersecurity procurement, see Pacific Northwest National Laboratory's Guide on Cybersecurity Procurement Language. It serves as a starting point reference to federal facility cyber procurement as it relates to OT specifically.

See FEMP's Energy and Cybersecurity Integration page for resources to help you understand your cybersecurity posture.