Dive Brief:

• The Department of Energy on Monday released a five-year plan to diminish the risk of energy disruptions due to cyberattacks, which have been increasing in "frequency, scale, and sophistication."
• The strategy is focused on three priorities: strengthening preparedness, coordinating responses, and developing the next generation of resilient energy systems.
• In just a few years, cybersecurity has become of paramount importance to the utility sector. Earlier this year the Trump administration established an office within the Department of Energy to focus on cybersecurity, energy security and emergency responses.

Dive Insight:

By all accounts, the threats faced by the energy sector are growing increasingly sophisticated and targeted, and the federal government has begun to increase security efforts. While major attacks have so far been thwarted, officials say hackers are getting better, faster.

"We must recognize today’s realities: resources are limited, and cyber threats continue to outpace our best defenses," according to the DOE report. "The nation's energy infrastructure has become a major target of cyber attacks over the past decade, with more frequent and sophisticated attacks that are increasingly launched by nation-states and cyber criminals."

The report also says attackers have shifted their goals from "exploitation to disruption and destruction." Cybersecurity is now "a top national priority," and the report lays out five-year goals for DOE' Office of Electricity Delivery and Energy Reliability (OE).

To strengthen preparedness, OE will focus on enhancing information sharing and situational awareness capabilities, and develop tools for bi-directional, real-time, machine-to-machine information sharing. For response and recovery, the office will establish a "coordinated national cyber incident response capability" specifically for the energy sector.

The report also calls for research and development into a new generation of energy equipment that has cybersecurity built in from the ground up. The report describes technologies that would "make future systems and components cybersecurity-aware and able to automatically prevent, detect, mitigate, and survive a cyber incident."

DOE also wants to see development of an annual cyber incident response exercise program and a boost in cyber exercises with non-federal government stakeholders. The North American Electric Reliability Corp. hosts a simulated grid attack, GridEx, every two years, and DOE is a participant. 

The exercise will be developed to "test and enhance coordination procedures within the energy sector," the report said. It "will include participation from industry, federal partners, and local, state, tribal, and territorial governments."

The last GridEx simulation, in 2017, included more than 6,000 individuals and more than 400 organizations. 

The utility sector's focus on cybersecurity grew rapidly in recent years — particularly after a 2015 outage in Ukraine caused by a cyberattack.

Utility Dive's 2017 survey of utility professionals concluded cyber and physical grid security was the most pressing issue facing the industry.