State utilities ready for cyberattacks
Given how we have come to take the reliable delivery of electricity for granted, the results of a survey of power and utility executives about the potential for a cyberattack disrupting service could be seen as shocking.
Nearly half of the chief executive officers of power and utility companies who responded to aKMPG survey released in November said they believed a cyberattack on their businesses is a matter of “when,” not “if.” And only 58 percent of the respondents felt their companies were prepared in their ability to identify new cyber-threats.
Connecticut utilities are working with state cybersecurity officials to assess their preparedness against cyberattacks. But company officials are reluctant to talk about the subject, even in the most general of terms.
Eversource Energy officials chose not to be interviewed for this story and referred all questions to representatives of the Edison Electric Institute, a trade group representing the nation’s investor-owned utilities. Officials with Clinton-based Connecticut Water Service asked that any questions about the utility’s cybersecurity readiness be submitted in writing, which is a departure from normal practice.
Eversource, United Illuminating and Connecticut Water, as well as Bridgeport-based Aquarion Water — which is owned by Eversource — all participated in this year’s annual assessment of their preparedness. Arthur House, Connecticut’s cybersecurity risk officer, led the assessment team and its findings culminated in the Connecticut Critical Infrastructure 2018 Annual Report, which was released in September.
“We believe that their current defenses are adequate,” House said. “But we’re all vulnerable and it is very sensitive to talk about that vulnerability. And it is so easy to be misunderstood.”
Scott Aaronson, vice president of security and preparedness for the Edison Electric Institute, describes the reluctance of Connecticut utilities to talk about the readiness of their cyber defenses as “a healthy paranoia.”
“Saying our security is good is like painting a bulls-eye on that company,” Aaronson said.
But according to Joel Gordes, a West Hartford-based energy consultant, being tightlipped about cybersecurity “is a missed opportunity.”
“Being silent is not a deterrent,” Gordes said. “It really leaves people to wonder whether or not they (the utilities) are prepared.”
The state’s utilities, according to the 15-page report prepared by House’s team, are “subject to a persistent, changing array of increasingly sophisticated and dangerous efforts to penetrate their communications and operating systems.”
“In some cases, more than a million distinct probes are received and deflected in a single day from both nation states and private actors,” the report says in part. “Attacks take varied forms, including both attempted systems compromise and phishing directed at employees. While there have been a large number of cyber incidents (attempts to penetrate communications or operations), none reached the level of an actual breach (penetration).”
The report identifies another, less obvious problem associated with Connecticut utilities protecting their operating systems: An inadequate supply of cybersecurity professionals.
“While the world of cybersecurity consultants and systems remains robust in the United States and for public utilities, the market for cybersecurity professionals is constrained,” the report says in part. “Human resources departments face challenges in recruiting, evaluating and retaining cybersecurity subject matter experts. It is difficult to attract technically qualified young people to utilities when such professionals are sought by other companies with higher salaries and by government agencies with more extensive resources.”
AForbes magazine article in August estimated by 2021, there will be 3.5 million unfilled cybersecurity positions worldwide. House said nationwide, there are 350,000 unfilled cybersecurity positions unfilled and 4,000 here in Connecticut.