It is a matter of debate that cyber attacks can be prevented by using “retro” technologies. Today, new technologies are used in many fields. One of the most discussed issues in the cyber world recently is the cyber tension between the USA and Iran. In this context, last month, after Iran shot down a US unmanned aerial vehicle, the US’s cyber attacks on Iran’s weapon systems came to the fore (1). The claim that the attacks were successful was denied by Iranian officials (2). However, news that the USA increased its digital attacks on Russia’s power grids brought the issue of cyber security in energy infrastructures back to the agenda.
Do Retro Technologies Reduce the Risk of Attacks?
One of the most important protection areas of cyber security is the energy centers of states, and the use of manual, or retro, technologies can be effective there. As a result, the wave of digitalization brought about a process that transformed critical infrastructure systems. In this context, it has become possible to talk about increasing cybersecurity vulnerabilities in these systems. According to the research report published by the Ponemon Institute (3), 90% of critical infrastructure operators state that their IT (Information Technologies) / OT (Operational Technologies) systems have been subjected to cyber attacks in the last two years. In this context, efforts to ensure cyber security of critical infrastructures, especially energy systems, are gaining momentum at international and national levels. According to the news of ZDNet (4), the USA plans to increase the security of power plants by requiring the use of “Retro”, that is, analog and manual technologies, as a defensive measure against cyber attacks. According to the news, the idea of using “Retro” technology aims to prevent a devastating attack on control systems, which are one of the most important components of the network.
Using Analogue Devices for Security
If approved, it is envisaged that SEIA (Securing Energy Infrastructure Act) and national laboratories (National Labs) in the USA will start a two-year pilot study. The study will include research on security vulnerabilities in electrical networks. In addition, working groups to be established will work on new analog devices that will protect critical systems from cyber attacks and isolate them. According to Cyware’s report, this bill in the USA was prepared by being influenced by the lessons learned from the cyber attack in Ukraine in 2015 and the power outage that affected more than 225,000 Ukrainians (5). According to researchers who examined the cyber attack targeting Ukraine, if the segmentation between the control systems and business networks of electrical infrastructures in Ukraine was not so strong, the attack could have had much more serious consequences (6).
While evaluating the bill proposal they submitted to the Senate in 2016, US senators King and Risch state that the bill aims to replace automated systems with low-tech vehicles. According to experts, this approach will require cyber attackers to need physical access to access the network, thus making cyber attacks more difficult. Before SEIA can be implemented, it must receive approval from the US House of Representatives under the Fiscal Year 2020 National Defense Authorization Act. If the bill is approved, a two-year pilot program will be launched to examine national grid operators and electricity grid operators and identify security vulnerabilities.
Energy Sector and Cyber Security
According to the report, the bill was inspired by the attack on Ukraine’s energy grids in 2015. In the attack, allegedly carried out by Russia-backed groups – BlackEnergy, a part of the country’s electricity network was seized by infiltrating industrial control systems. The attack left more than 225,000 Ukrainian citizens without electricity on Christmas Eve. According to experts, analog systems played a major role in overcoming the attack with relatively less damage. It is claimed that the attack could have had much more serious consequences if Ukraine’s energy network was not based on manual technology. Through SEIA, the aim is to limit the damage of any possible cyber attack on the US power grid in a similar way as in Ukraine.
According to the news on ZDNet, the relevant bill was brought to the agenda as a result of Symantec reporting that a Russian hacker group was targeting electricity network operators in 2017. U.S. intelligence officials have long warned that China and Russia have the technical capabilities to infiltrate power grids. Last month, the Trump administration announced that Russia was stepping up cyber operations targeting Russia’s power grid in response to the United States focus on the energy sector. These developments point to the increasing struggle of cyber threat actors over power grids.
Resources:
- BBC, “US ‘launched cyber-attack on Iran weapons systems”, 23 Haziran 2019, https://www.bbc.com/news/world-us-canada-48735097
- Aljazeera, Iran denies being hit by US cyberattack, 24 Haziran 2019, https://www.aljazeera.com/news/2019/06/iran-denies-hit-cyberattack-190624064421998.html
- Ponemon Institute, “Cybersecurity in Operational Technology: 7 Insights You Need to Know”, http://imt.com.mx/wp-content/uploads/2019/04/PonemonCybersecurityinOTReport.pdf
- ZDNet, “US wants to isolate power grids with ‘retro’ technology to limit cyber-attacks”, 02 Temmuz 2019, https://www.zdnet.com/article/us-wants-to-isolate-power-grids-with-retro-technology-to-limit-cyber-attacks/
- Cyware, “US wants to isolate power grids with ‘retro’ technology to limit cyber-attacks”, 02 Temmuz 2019, https://cyware.com/news/us-wants-to-isolate-power-grids-with-retro-technology-to-limit-cyber-attacks-a4a7b660
- Security Today, “Senate Passes Bill To Explore ‘Analog’ Solutions to Securing America’s Energy Grid”, 09 Temmuz 2019, https://securitytoday.com/articles/2019/07/09/senate-passes-bill-to-explore-analog-solutions-to-securing-americas-energy-grid.aspx