How can we protect our energy sector against cyber attacks and build resilience to global threats?
Anna Poblocka-Dirakis, Senior Expert for Digital Technologies at dena, on the current threat posed by internationally organised cyber attacks on energy infrastructures - and why there can only be one global response to this new challenge.
Digitalisation of the energy system increases the risk of cyber attacks significantly. As the attackers are usually international players, the defenders have to be globally networked too. Hence more international cooperation is needed for cyber security.
The energy sector is currently undergoing a fundamental transformation: away from the centralised feed-in and decentralised consumption of energy towards a more complex and increasingly networked system with a much larger number of generation plants, grids and storage facilities. These globally more complex systems not only increase the effort required for coordination, but also for security. Digital technologies such as smart grids and AI bring huge benefits, but make the energy system more vulnerable and susceptible to cyber attacks. And not just in Germany, but worldwide.
International cyber attacks
According to the International Energy Agency, the number of reported weekly cyber attacks on energy systems worldwide rose sharply from 499 in 2020 to 1,101 in 2022. Not all attacks are reported, and consequently a significantly higher number of unreported cases can be assumed.
These attacks are carried out by global players, either private hacker groups that finance themselves through ransomware attacks or players that are supported by national governments. These groups act internationally, exchange information with each other and learn a great deal from each other.
In order to protect and defend energy systems against internationally organised criminal groups or individual perpetrators, cyber experts have to network worldwide, share their experiences and develop joint platforms and formats. In this way, international cooperation between cyber security experts for energy systems can form a counterbalance to internationally organised criminal groups. Where there is a global threat, there also needs to be a global response. International standards for cyber security in the energy sector are needed for supply chains as well as clearly regulated processes for dealing with cyber attacks.
Digitalisation and cyber security in international dialogue
Experts practised countermeasures in the event of cyber attacks in a simulation.
The Federal Ministry for Economic Affairs and Climate Action's energy partnership between Germany and Israel has been dealing with these issues for years, as well as with the question of how cyber security can be addressed in dialogue between governments.
As a particularly innovative format for this, dena, as the implementing organisation of the energy partnership, developed a multilateral expert trip on crisis communication and management in cyber security in the energy sector and organised it here in Germany in November.
In addition to visits to the Federal Office for Information Security (BSI) and the Federal Network Agency (BNetzA) as well as German transmission system operators, a multinational cyber security exercise was the focus of the trip. Here, the experts had to react to an acute threat situation in a simulation and develop possible strategies and countermeasures. It was a highly productive exchange that once again emphasised the urgency of the task. Around 30 experts in total from Israel, the USA, Australia and Germany took part in the cyber security exercise and the subsequent trip.
Conclusion
The increasing digitalisation of the energy sector means that the energy supply, and with it the basis of modern society, is becoming more vulnerable to cyber attacks. However, this does not mean we should do away with digitalisation. There are numerous measures to secure systems that need to be implemented and developed further. Cooperation between like-minded international players in particular can be a decisive step here.
