Energy convergence and cybersecurity grid challenges

By Steven O’Sullivan
Enzen's Steven O’Sullivan explains why cybersecurity should be baked into procurement and partnership programmes from the outset

The convergence of previously separate sectors around smart grids is creating a disparate energy value chain with divergent cybersecurity practices and vulnerabilities, eroding organisational control over energy security.

Failure to consolidate cybersecurity practices across diverse value chains could result in cyber-attacks causing financial and reputational damage. Fear of cyber-attacks has already reduced consumer take-up of smart meters. The scale of the threat is demonstrated by a recent rise in ransomware attacks targeting energy networks; from pipelines to power grids.

Weak links in the energy value chain

Smart grids are driving the convergence of energy and technology. This leaves grids at the mercy of the security practices of third-party technology companies. Many suppliers now need continued access to customers’ energy networks to perform remote maintenance, creating more potential vulnerabilities. 

A porous perimeter

Edge devices such as smart appliances and sensors further increase the attack surface around energy networks. These devices are made by technology suppliers with varying standards of security, creating a wider array of vulnerabilities.

Some manufacturers sacrifice security for speed to market, compounding the issue. As energy security can no longer be centrally controlled, we now require new frameworks to inform best practice across this value chain.

A holistic security framework

Without direct control over energy security, grid operators must use cybersecurity frameworks to assess business risk across all cyber, digital and data projects and enforce best practice among all partners and suppliers. 

Cybersecurity should be baked into procurement and partnership programmes from the outset. Imposing cyber frameworks on Tier 1 suppliers would create a cascade of best practice as each tier enforces the same standards on lower tiers. All projects should be interconnected from the start so that risks are continuously assessed as new technologies are added. 

Organisations should get an integrated overview of all business risk across digital projects so that digital ecosystems are monitored and managed as a ‘system of systems’.  Companies also need to manage third-party remote maintenance of energy infrastructure with strict user permissions.

All suppliers must also be vetted to ensure they conduct continuous patching of products. The renewable energy industry should adopt frameworks encompassing suppliers, OEMs and energy producers that ensure consistent cyber security best practice across asset lifecycles and across an increasingly diverse energy ecosystem. 

Steven O’Sullivan is Head of Smart Cybersecurity at Enzen 

Share

Featured Articles

Earth Day 2024: Renewable Energy Key To Sustainable Future

Celebrated annually on 22 April, Earth Day 2024’s main theme centres around ‘People vs Plastics’ but also looks at sustainability as a whole

What's Apple’s Promise on Clean Energy and Water Investment?

Tech giant Apple is working to increase its sustainable output, supporting more than 18GW of clean energy use & billions of gallons in water savings

Data Centre Demand Putting Pressure on Energy Capabilities

Utilities in the US are predicting a tidal wave of demand for data centres thanks to the boom of AI, which, in turn, will dial up the need for electricity

Q&A with Hitachi Energy’s EVP & Head of North America

Sustainability

OMV Takes Strides in Energy Efficiency & Emissions Reduction

Sustainability

Q&A with RAIN Alliance President and CEO Aileen Ryan

Technology & AI