Energy cyber security: why going digital opens the door to attack

The cleaner, smarter energy system Britain is building is also a larger target for cyber attack, and the security thinking has not always kept pace with the wiring. That is the concern raised by Sean Arrowsmith from NCC Group, in a conversation published by Energy Live News covering energy cyber security risks as the grid becomes more connected.

More renewables, more batteries and more digital controls mean more of our homes and businesses will eventually be talking to the grid. Arrowsmith’s point is that every piece of connected kit is also a potential way in for an attacker.

The wall between IT and physical systems is coming down

The traditional separation between office IT systems and the technology that controls physical infrastructure (switching gear, substations, storage) is disappearing. Arrowsmith describes what that means in practice: ‘The digitalisation that’s happening within the energy market more and more, so, you know, the drive for a modern energy system, for net zero purposes, but also for just better management of those systems. So yeah, that convergence between IT and what we call operational technology that controls those physical processes within energy substations, etcetera. Bringing those two together has brought the attack surface out to the attackers and made it more available.’

The problem is not limited to the established large energy companies. Thousands of new businesses are entering the system through renewables, storage and distributed energy, and some are learning the realities of critical infrastructure as they go. Arrowsmith puts it plainly: ‘You’ve got lots of new firms coming into the energy market in terms of renewables. You’ve got battery and these energy storage solutions. They look relatively innocuous from a technology standpoint but it’s really important that those are architected in the right way and that security is built in at the engineering point in the design phase to make sure that we don’t introduce more risk into the system.’

One example illustrates how easily things can go wrong. A business can install sophisticated, expensive equipment and then undermine it entirely by leaving a default password unchanged. That is precisely why Arrowsmith argues security must be part of the engineering process from the outset, not an afterthought bolted on once everything is built and running. ‘When actually you’re building the kind of systems architecture for these sites, you’re thinking about security in that context from the very start. Because if you build it in from the start, it’s much easier to then implement, get right, and also you don’t have to retrospectively go and re-engineer stuff and take stuff out to fix it.’

AI is already involved, on both sides

Asked about artificial intelligence, Arrowsmith gives a frank answer: ‘Unfortunately that is already a reality. So that kind of level of automation coming in is happening. And it’s happening on both sides and to a certain extent, cyber because of its very nature, there’s always been something of an arms race and we’ll continue to see that go on into the future.’

Arrowsmith is not predicting a Hollywood scenario in which someone presses a button and the lights go out across Britain. The energy sector is increasingly focused on resilience, containment and how quickly systems can recover when something does go wrong. But the underlying tension he identifies is straightforward: we are building a cleaner energy system that is also far more digital, and security needs to be designed in from the start rather than added once the build is complete.

The full conversation with Arrowsmith is available on the Net Hero Podcast, distributed wherever podcasts are available.