What’s the cost of securing the nation’s energy from a cyber attack?
Amid rising threats, including a recent attack on several U.S. power and natural gas suppliers, energy companies are now spending less than 0.2 percent of their revenue on cybersecurity, at least a third less than financial institutions, according to Precision Analytics and The CAP Group, security consultants that work within the industry.
Symantec Corp. says it’s tracking at least 140 groups of hackers actively targeting the energy industry, up from 87 in 2015.
“It’s scary,” said consultant Brian Walker, a former head of global information technology for Marathon Oil. Executives making funding decisions “aren’t necessarily millennials who intuitively understand” how cyberthreats reach seemingly disconnected units.
“It’s guys my age that are the problem,” according to Walker, who said he’s in his early 50s. “We’ve been 30-years trained in a world that doesn’t work this way anymore.”
Earlier this month, at least seven pipeline operators from Energy Transfer Partners to TransCanada said their third-party electronic communications systems were shut down, with five confirming the service disruptions were caused by hacking.
Though the attack didn’t disrupt supply, it served to underscore an ongoing vulnerability to electronic sabotage. It showed how even a minor attack can jump between systems with ripple effects, forcing utilities to warn of billing delays.
This “cyber blind spot is a real challenge,” Walker said. “Our fear is that we will play an ostrich and put our head in the sand until something blows up and people get killed or until the lights go out for a month.”
The threat isn’t new, but it is escalating.
In 2012, Saudi Aramco production was locked down during the disk-wiping Shamoon incursion, and the company was hit again by the same group in November 2016, said Bill Wright, director of government affairs and policy counsel for Symantec in Washington. In 2015 and 2016, Ukraine was hit with blackouts by state sponsored groups, a blow to the economy as well the healthy and safety of its citizens.
In the U.S., Symantec has been following another group, nicknamed Dragonfly, that’s been around since at least 2011. Last year, the group became “a lot more aggressive,” with the goal of soliciting information on how energy companies work and figuring out how to maintain stealth access on their systems, according to Wright.
The Federal Bureau of Investigation and the Department of Homeland Security issued a joint technical analysis about a month ago, tying Dragonfly to the Russian government and describing its ability to conduct sabotage, Wright said.
The low levels of spending by the industry comes as it rushed to adapt new ways to produce more product at a lower cost amid and following a historic, three-year rout in oil prices.
Over the last few years, the industry has been quickly adding electronic sensors and other monitoring capabilities to track data from 900,000 oil and gas wells, and 300,000 miles of pipelines. Complex computer algorithms at every level of the industry are constantly adjusting the flows of everything from oil and natural gas to electrical power, with automatic valves in place that can shut down flow at a moment’s notice in the case of an accident with no human action needed.
And all of it is hackable, according to Walker and other experts.
“This equipment is fairly wide open from a security perspective,” said Matthew Stegall, director of IT assessments at Precision who performs such assessments for Deloitte & Touche LLP and KPMG LLP. “Companies are starting to more and more look at this. But they are still very much in the infancy stage.”
Many of these operations run on separate networks, offering an “air gap” that energy companies often cite as a shield against wider ranging intrusions. But that’s also created a false sense of protection, according to Gent Welsh, commander of the 194th Wing of the Washington Air National Guard who’s long been involved in developing cybersecurity capabilities.
Making the leap from attacking corporate systems to those involving operations “is not hard at all” for experienced hackers, Welsh said.
Companies are aware of the need protect raw data, but they’re often less sophisticated about the need to protect recently computerized systems for operational assets, according to Stegall. “When you get to a discussion on locking down the operations issues, they kind of look like deer caught in the headlight,” he said.
Based on analysis developed over 15 years, energy companies that earn $1 billion in revenue a year generally spend about $1 million for cybersecurity, Precision found. In comparison, companies within the financial industrial with $1 billion in revenue could spend as much as $3 million. according to the data. Financial services and retailers have been in the limelight for data breaches.