Ready to Respond: The Electricity Sector and Evolving Cyber Threats

Reliable and resilient electricity is essential for Canadians. This is why electricity companies work 24/7 to keep the grid secure and reliable. While the pandemic has been prevalent in all facets of business and life this year, COVID-19 has not been the only challenge electricity companies are addressing in 2020. Perhaps even more prevalent is the evolving cyber security threat landscape.

The National Cyber Threat Assessment (‘NCTA’), recently published by the Canadian Centre for Cyber Security, states that not only are the number of cyber threat actors is rising, but they are also becoming more sophisticated. It finds that ‘state-sponsored actors are very likely attempting to develop cyber capabilities to disrupt Canadian critical infrastructure, such as the supply of electricity, to further their goals.’

The report also describes that while advancements in technology are spurring innovation and transformation, helping to make our lives better– the growth technologies such as of the Internet of Things, the Industrial Internet of Things and automation also mean new risks in the cyber security landscape that companies must adapt to.

Most of the cyber security issues outlined in the report are not surprising to those in the electricity sector; this is the reality they face for every day as they continuously work to protect the grid against dynamic threats.

Protecting the grid is a top priority for Canadian electricity companies, a responsibility the sector takes seriously. From activities such as complying with cyber security standards as a baseline, participating in forums for security information sharing, continuously taking proactive actions to prevent and respond to physical and cybersecurity intrusions, practicing response to major events, striving to foster a culture of security, and making investments to support physical and cyber security – this work never stops.

Also essential are partnerships with the broader electricity security community, such as the Canadian government, including with the Canadian Centre for Cyber Security. Given the integrated nature of the Canada-U.S. electricity grid, Canadians also cooperate with their Americans counterparts on electricity security – engaging in unity of effort and response to evolving threats facing the electricity sector.

But as shown in the NCTA, threats against the electricity sector and the threat landscape itself continue to evolve. This comes at a time when electricity is becoming even more essential, and we are becoming even more digitally connected.

With transformations being brought about by technological advancements such as AI and the growth of the Internet of Things, and with policymakers and businesses looking to achieve clean energy goals through electrifying the economy, electricity will only become even more important.

And this is good. More electricity can power more innovation– creating jobs and opportunities for Canadians. More electricity can mean more digital connectivity – making our lives more efficient and easier. Electrification can lead to a clean growth economy and help us achieve climate goals.

But none of this is possible without secure electricity. In short, secure, reliable electricity is essential for our way of life.

Given the cyber threat landscape, ensuring this imperative will require that the electricity sector, other critical infrastructure sectors and governments continue to not work in isolation. No one sector or government can do this alone. Addressing evolving, more prevalent and increasingly sophisticated threats means that it will be essential to forge deeper trusted partnerships throughout the critical infrastructure security community to work in unity to make things more secure.

To that end, the Canadian electricity sector continues to encourage deeper partnerships between industry and government on this issue.

Now, more than ever, it will be important that government partners continue to invest in programs and policies that serve to support the security posture of Canadian critical infrastructure, and to continue to show leadership on these issues.  This includes helping to promote and train a cyber workforce that is ready to take on the cyber challenges of tomorrow. It includes deepened support for cyber security information and intelligence sharing programs between industry and government. It includes enabling electricity companies to take cyber security actions though continuing to provide actionable and timely information. It includes partnership to find solutions to the major cyber security issues we face today, such as the security of IoT devices and supply chain cyber security.

The need for electricity is only going to grow in the future. And the system that makes, moves, and delivers that electricity is only going to become more networked and connected. Malicious actors- motivated by any kind of malice, money, or politics aren’t going to go away. Collectively, we can’t let our guard down.