Energy remains a vital sector in the UK, providing energy supplies to local markets, as well exporting internationally. However, in recent years, the Energy Sector has become the UK’s top target for cyber attacks, accounting for 24% of all UK cyber attacks in 2021. With increasing pressure on supply chain challenges and energy costs, it has never been more important for Energy companies to focus on cybersecurity risk management.
Aberdeen based IT security company, Nimbus Blue, works with companies to manage cyber risks such as ransom attacks and phishing attacks, which is now one of the top infection methods used against UK businesses and, according to a recent IBM report, led to 63% of cyber incidents in 2021.
Nimbus Blue’s Security Lead, Andy Turner, said: “Whilst any business or individual can become a target, Energy sector companies have several characteristics that make them more attractive for cyber criminals. Operational Technology (OT) that is used within the Energy sector can be a prime target for state-sponsored groups aiming to disrupt supplies, or organised cyber gangs seeking financial gains. These systems run the plants, and control the flow and production of energy, so if they are compromised the impact can be devastating. Quite often, these OT systems are installed and never patched, and if they have any connection to the internet, either directly or indirectly via a workstation, they can be vulnerable to attacks.”
Data theft is also a growing concern with Intellectual Property (IP) providing a potentially high return for cyber criminals who either sell stolen IP to competitors or hold data to ransom.
“Ransom attacks can either be in the form of ransomware, which encrypts the data, blocking access until a ransom is paid, or data exfiltration, which is the removal of the data from the company network with the threat of it being sold on the dark web, unless the ransom is paid,” said Andy. “Recently, these attacks have been seen working in tandem, with the original data being exfiltrated then encrypted, limiting the options of the targeted company.”
Whilst advanced security software and regular vulnerability testing is vital to reduce the risk and impact of cyber attacks, staff are often the first line of defence.
Emphasising the importance of staff in any cybersecurity risk management plan, Andy said: “More than ever, Energy companies today need to stay security aware and ensure sufficient investment in the right places, and this includes your staff. By combining more secure systems and processes with user awareness training, staff will be empowered to make the right decision and spot a phishing email or system vulnerabilities; potentially mitigating a cyber attack that could have a lasting operational, financial, and reputational impact on your business.”