Cyber and Security

Overview

Integrating physical and cyber security is crucial for utilities to safeguard critical infrastructure. As a trade association focusing on utility information and communication technologies (ICT), the Utilities Technology Council (UTC) recognizes the growing threats to physical and cyber assets owned and operated by electric, water, and natural gas utilities. With utilities increasingly adopting digital technologies and connected devices, the convergence of physical and cyber domains necessitates a comprehensive security strategy that addresses both areas simultaneously.

Background

Utilities operate in a complex environment where physical and cyber threats constantly evolve. The physical security of substations, control centers, and other critical infrastructure has traditionally been a priority. However, with the rise of digitalization and interconnected systems, cyber threats targeting utility communications and ICT have significantly increased. These threats include ransomware attacks, supply chain vulnerabilities, and sophisticated intrusions to disrupt services and steal sensitive information.

As we’ve seen, the Colonial Pipeline event and the emergence of state-sponsored cyber groups like Volt Typhoon have underscored the urgency of enhancing security measures. Moreover, given the growing use of new technologies such as artificial intelligence by threat actors, utilities face an ever-evolving threat landscape that threatens the economy, public safety, and national security.  As the reliance on ICT grows, utilities must develop robust defenses integrating physical and cyber security to mitigate these risks effectively.

Key Issues

1. Convergence of Physical and Cyber Security Threats

• Modern utility infrastructure is increasingly interconnected, blending physical systems with digital controls. This convergence creates new vulnerabilities where cyberattacks can have physical consequences and vice versa.
• Threat actors are employing more sophisticated tactics, such as Living off the Land (LotL) attacks, which use legitimate software and tools for malicious purposes, complicating detection and response efforts.

2. Challenges in Implementing Comprehensive Security Measures

• Utilities face challenges integrating physical and cyber security measures due to legacy systems, resource constraints, and varying maturity levels across organizations.
• Coordination between different departments and stakeholders—such as IT, OT, and physical security teams—is often lacking, leading to gaps in overall security posture.

3. Supply Chain Risks

• The global supply chain for ICT and operational technology (OT) components introduces additional risks. Insecure supply chains can be exploited to introduce malicious hardware or software, compromising utility networks.
• Third-party vendors and contractors often have access to sensitive systems and data, creating potential vulnerabilities if not properly managed.

4. Regulatory and Compliance Requirements

• The regulatory landscape for utilities is becoming increasingly complex, with new requirements such as NERC CIP standards and evolving state-level mandates for physical and cyber security.
• Ensuring compliance with these regulations while maintaining operational efficiency can be challenging for utilities

Recommendations

1. Develop Integrated Security Strategies

• Adopt an integrated security approach that combines physical and cyber aspects. This includes regular risk assessments, joint exercises, and the implementation of comprehensive security frameworks such as IEC 62443 or NIST Cybersecurity Framework.

2. Enhance Cross-Departmental Collaboration

• Encourage stronger collaboration between IT, OT, and physical security teams. Establish clear communication channels, shared goals, and unified response plans to ensure a coordinated defense against threats.

3. Strengthen Supply Chain Security

• Implement stringent supply chain security measures, including thorough vendor vetting, continuous monitoring, and regular audits, to ensure the integrity of ICT and OT components.

4. Invest in Advanced Security Technologies

• Invest in advanced security technologies, such as AI-driven threat detection, automated response systems, and multi-factor authentication, to enhance physical and cyber defenses.