Energy’s Biggest Challenge? Modernizing Lines of Defense
The riskiest position for a company to take when it comes to its cyber governance, risk, and compliance (GRC) practices is the attitude that “it could never happen to us.” The truth is, risk is everywhere, all the time—and it’s more likely a breach will happen than it won’t.
Being risk-ready is especially crucial in the energy sector, where complex operations comprise a critical part of modern global infrastructure. Moreover, the energy sector is interconnected with other infrastructure sectors, such as water, transportation, and telecommunications. A cyberattack on one sector would have cascading effects on others.
COMMENTARY
Yet, the energy sector still lags other industries in implementing modern technology and risk groundwork. There’s a reason the U.S. Department of Energy and the World Economic Forum, among other international bodies, have emphasized the importance of energy cyber risk GRC through multi-year strategic plans.
Improving Cyber Defenses
It’s mission critical for the energy sector to bring its risk and cybersecurity practices up to the highest level as quickly as possible. The following are four ways companies can focus on modernizing their cybersecurity defenses.
Fight Diverse Cyber Threats on Multiple Fronts. Risk experts have been flying the cybersecurity “bat signal” for years about just how dangerous the diverse cyber threats are to the energy system. According to the X-Force Threat Intelligence Index 2023, the energy industry is the fourth-highest industry sector to be targeted by cyberattacks. In recent years, the U.S. energy sector has suffered several high-profile attacks from foreign hackers, most notably the Colonial Pipeline—risks that go far beyond protecting the physical infrastructure of the refineries, power plants, and energy grids that keep our day-to-day operations going. These threats will only get harder to fight as hackers improve their techniques.
In addition to improving and overhauling outdated legacy security systems, energy companies should pay close attention to the threats lurking in internet of things (IoT) devices. The energy sector relies heavily on “smart” devices like energy meters, thermostats, and other operational technologies to control critical assets. Each of these devices represents a potential entry portal for a cyber attacker to disrupt the energy grid with devastating efficiency.
Address the Talent Shortage in the Energy Sector. To fight an onslaught of global cybersecurity threats, energy companies need to recruit and train the workforce equivalent of an elite cybersecurity cavalry just to keep infrastructure safe. But there are still over 650,000 cyber jobs to fill nationwide, according to recent CyberSeek data. There’s a massive opportunity for job seekers in the energy sector as energy companies look to close these jarring talent gaps.
Comprehensive and automated digital cybersecurity tools can make great strides in helping energy companies shore up their talent shortage, but they also need knowledgeable and talented cyber risk leaders at the helm, analyzing risk signals and making decisions. In addition to recruiting more energy cyber talent, energy companies must ensure that all employees are well-trained in cybersecurity awareness and compliance. Human error is one of the most common causes of security breaches, so ongoing education is crucial to ensuring energy systems stay secure.
Focus on Regulatory Compliance. Regulatory requirements in the energy sector can change as frequently as every day as new threats emerge, and governments update their policies. These changes happen not only within the U.S., but also on a global scale, with many regulatory systems to track. Energy companies—particularly during a talent deficit—may struggle to keep up with these changes. Many energy companies still rely on legacy systems that were implemented before modern cybersecurity regulations existed. It’s tough to manage, even for companies working toward updating their GRC practices.
Ensuring compliance while managing cyber risks demands dedicated resources and expertise to protect critical infrastructure effectively and avoid financial repercussions. Consider investing in more cybersecurity workers well-versed in regulatory compliance as well as adding on digital tools to help monitor, track, and implement regulatory controls to assist the cyber team.
Invest in AI. Cybersecurity leaders always have an eye on the future—not just about what risks could happen, but also what solutions could help prevent future attacks. The predictive capabilities of artificial intelligence (AI) have not been fully leveraged in the GRC world yet, across industries. This will be a key trend to track in the next several years as AI for businesses—and AI for GRC—improves across the board.
The decision-making power of humans is essential for effective, modern GRC. This is undeniable and non-negotiable. But with so many threats to monitor, humans can’t see it all or do it all as effectively or efficiently as humans with a digital assist. AI can help spot security breaches or even model future potential breaches trained on data from the past.
Stay Vigilant
There are many tools out there exploring the future of AI in GRC. Energy sector GRC leaders have a major opportunity to be on the cusp of this innovation, further bolstering the security of our energy network.
Energy companies can’t afford to say “it could never happen to us.” Modern cybersecurity governance is the best line of defense to protecting our critical infrastructure.
—Gaurav Kapoor is co-founder and co-CEO of MetricStream.