By Wayne Tung, Managing Director at Sendero Consulting
Historically, the utility industry has been thought of as reliable, slow moving, and heavily regulated. People want to know that their lights will turn on and water will run, and by prioritizing that consistency, the general public and regulators have not pushed the industry to be particularly innovative. However, in recent years, the utility industry has transformed to become modern, innovative and technology-centric with cutting edge automation and controls. With the increased reliance on technology, the need to invest in cybersecurity has pushed utility companies to the cutting-edge of cybersecurity innovation.
With technology driving utility operations, a cyberattack against critical infrastructure, including the power grid and water systems, has the potential to cause catastrophic consequences. Even a data breach that doesn’t directly impact critical infrastructure can become extremely costly. In fact, according to IBM, the average cost of a data breach hit a worldwide record high in 2022, reaching $4.72 million in the energy sector.
Government Regulation as a Force for Change
In the utility industry, cybersecurity serves as the fortress within the organization. Just as you secure your home against potential intruders, cybersecurity protects utility organizations from technology breaches that impact the intricate systems managing power plants, grids and overall business operations. Common regulations such as the North American Energy Reliability Corporation’s (NERC) Critical Infrastructure Protection (CIP) standards were created to keep the fortress secure. Regulations impose stringent requirements on utilities, ensuring that only authorized personnel and trusted advisors can operate within the highly secured environment. As another impact of these regulations, utility organizations have been compelled to collaborate with government agencies in an ongoing effort to identify, manage and communicate emerging vulnerabilities and risks. This proactive approach has positioned the industry to embrace new technologies as they come to market, rather than relying on periodic updates every few years.
The Role of AI
As automation, AI and machine learning take over the digital landscape, utility companies are using these technologies to fortify their organizations against threats. For example, automation streamlines routine security tasks, such as threat detection and response, enabling utilities to detect and mitigate cyber threats in real-time. AI and machine learning solutions can continuously analyze data to identify shadow data, monitor for abnormalities and alert cybersecurity professionals about potential threats.
One major application of AI in utilities cybersecurity stems from the ability of artificial intelligence to spot threats faster than humans and monitor a range of potential cyber issues. The rise of AI and automated cybersecurity technologies has also allowed the utility industry to decrease human error as professionals try to keep up with the increased volume of attacks.
Barriers to Implementation
When adopting new cybersecurity solutions, utility companies will often encounter the most significant hurdles during the implementation stage. Despite an organization’s desire to incorporate new technology and processes, the industry is challenged by limited availability and experience in resources needed for new implementations. Technology and cybersecurity skill levels can be critical bottlenecks in the process as even the most advanced systems require human oversight and intervention for effective operation.
Cybersecurity education is critical during this implementation phase. Imagine a home with the best alarm system and security cameras. This technology is effective in both deterring bad actors and detecting suspicious activity, yet, if the front door of the home is left open, the protection offered by the technology doesn’t matter. Employee education is a necessary part of a cybersecurity strategy for this reason. The protection the technology offers won’t matter if a bad actor gains access to critical systems through a malicious URL or guesses the password on an unattended laptop at a coffee shop.
Measuring the ROI
Even when an implementation is successful, many organizations overlook the importance of assessing the technology’s long-term value. It can be challenging to evaluate the return on investment, especially when that evaluation requires additional time and resources. However, neglecting this post-implementation value assessment means missing insights into the effectiveness of new cybersecurity measures. It’s incredibly valuable to measure how many threats or attempted breaches the technology prevented, and to extrapolate the potential cost of each incident. This comprehensive understanding will enable organizations to allocate resources efficiently in the future.
Looking forward, the utility industry will continue to be a pioneering force in adopting innovative cybersecurity technologies to protect its data and evolving technology solutions, which serve as a blueprint for other industries to follow. Through the industry’s strict regulations and investment in new technologies, the utilities sector continues to forge the path forward to a secure digital future.
