How cyber attacks could threaten the energy transition [partner content]

Security experts often say there are two kinds of companies. “There are those companies that have been hacked, and those that don't know that they are being hacked – especially when we look at the energy industry,” says Bilal Khursheed executive director of Microsoft's global power & utilities business. Khursheed works with companies to deploy digital technologies to speed up the clean energy transition. And he also focuses heavily on a threat that could derail the transition – cyber attacks. There are two reasons for this. One is the rise of internet-connected devices. There are now 15 billion IOT devices connected around the world, with a huge number of them on power grids. The other reason is sophistication. More attacks are now coming from organized groups, many of them with political motivations. “These aren't just your random hackers. These are highly sophisticated James Bond villain types that are targeting our energy systems,” explains Khursheed. In this episode, produced in partnership with Microsoft, Bilal Khursheed talks with Stephen Lacey about the evolution of cybersecurity threats in energy. They discuss how the threats are changing, their consequences for critical infrastructure, and how solutions are improving in the age of AI. This episode was produced in partnership with Microsoft. After listening to the podcast, you can read about how to navigate NERC CIP compliance in the cloud, learn how energy firms around the world partner with Microsoft on security, and dig into the 2024 Microsoft Digital Defense Report.

• 0:02Speaker 00

  Security experts often say there are two kinds of companies.

• 0:11Speaker 01

  There are those companies that have been hacked and then there are those that don't know that they are being hacked, and especially when we look at the energy industry.

• 0:22Speaker 01

  Just last year, in 2023 alone, about 25% of all cyber incidents targeted critical infrastructure, and the energy sector was among the top three.

• 0:33Speaker 00

  Bilal Khrushid is the Executive Director of Microsoft's Global Power and Utilities Business. He works with companies to deploy digital technologies to speed up the clean energy transition. And he also focuses heavily on a threat that could derail the transition: cyber attacks.

• 0:48Speaker 01

  To put it plainly, where does it fit into the overall scope of my role? I would say cybersecurity is my role. It's woven into every decision, every strategy, every solution that we deliver to protect and power our future.

• 1:00Speaker 00

  Attacks on energy companies are increasing. There are two reasons for this. One is the rise of internet-connected devices. There are now 15 billion IoT devices connected around the world, a huge number of them on power grids.

• 1:13Speaker 01

  This number is expected to exceed 30 billion within the next six years by 2030. And every new connection in the grid creates a new vulnerability. As utilities undergo more and more digital transformation, integrating smart grids and IoT devices, line sensors, assets in substations that are connected to networks, in essence, through this, we're adding more digital doors, or digital windows, so to speak.

• 1:42Speaker 00

  And the other reason is sophistication. More attacks are now coming from organized groups, many of them with political motivations.

• 1:50Speaker 01

  A lot of them, in some cases, are state-sponsored. In the last year, we've seen a 40% spike in nation-state attacks on critical infrastructure. These aren't just your random hackers eating a bag of Cool Ranch Doritos and sipping on Diet Coke in your mom's basement. I mean, these are highly sophisticated James Bond villain types that are targeting our energy systems.

• 2:17Speaker 00

  Utilities are digitalizing their operations quickly to better manage the grid. But the convergence of information technology with operational technology also brings new risks. In this episode, produced in partnership with Microsoft, Bilal Khashid talks with Stephen Lacey about the evolution of cybersecurity threats. They discuss how the threats are changing, their consequences for critical infrastructure, and how solutions are improving in the age of AI.

• 2:43Speaker 01

  It is a reality that the industry grapples with daily. While we talk about smart meters and smart grids and smart appliances, we also have to talk about smart security as well.

• 3:02Speaker 02

  What are the different types of attacks that you're seeing? And what are the motivations of the attackers if we are seeing more from state-sponsored groups?

• 3:10Speaker 01

  Yeah, it's a great question. I mean, these threats are becoming more and more complex, day by day. They've gone beyond the days of just simple malware or ransomware. Today, the attacks are highly targeted, they're organized, and can be devastatingly precise as well. So if we look at the types of attacks that we're seeing, I think first, there's the ransomware attacks, where hackers will lock up critical systems and demand a ransom to release them. You've seen a lot of this over the last few years with the Colonial Pipeline attack that caused significant panic buying and fuel shortages. But it's one that is happening on a regular basis.

• 3:53Speaker 01

  And just imagine if that type of attack targeted a city's power grid. It's, to me, a very chilling thought, but a reality that we're preparing for. Then there's the phishing or social engineering attacks, which sound a bit less technical, but are often the entry point for very larger breaches. And if you look at humans in the link when it comes to this, it's often reported that humans are the weakest link in the security chain. And gaining access through phishing or disrupting some level of an internal network or critical system, we've seen cases of this as well. And the last element that I bring up is what we call APTs, which are advanced persistent

• 4:35Speaker 01

  threats, which are some of the most dangerous in my opinion. These are the long-term stealthy attacks. They're often state-sponsored, where a hacker might gain access to a critical infrastructure system and just lie in and wait, sometimes for months, even years, gathering intelligence or planting mechanisms that will disrupt services down the line. And our own research here at Microsoft shows that we've seen a 40% increase in state-sponsored attacks on critical infrastructure, and the energy sector is high on that list.

• 5:11Speaker 02

  And what about the motivations piece?

• 5:14Speaker 01

  Yeah, I mean, they range widely. Financial gain is a big one, especially with ransomware. But then there's also politically motivated attacks as well. State-sponsored groups will often look to destabilize another nation's or gain strategic advantage by targeting parts of their critical infrastructure. Then you have the hacktivist angle, where certain groups or certain ideological motives aim to disrupt or make a statement by attacking an energy company that may not align with their social values. So, I mean, in short, we're seeing definitely more targeted, more sophisticated, more persistent, a very wide array of motivations.

• 5:58Speaker 01

  But ultimately, the end goal for us as an industry is resilience, right? So ensuring that as these threats grow and change, that we stay a step ahead and protect the backbone of our modern infrastructure.

• 6:11Speaker 02

  You talked about the expansion of IoT devices. We've got now tens of millions of sensors, inverters, smart meters, EV chargers, lots of IoT devices in homes. How is that changing the cybersecurity outlook? And are there any particular vulnerabilities within that really large class of technologies?

• 6:32Speaker 01

  Yeah, Stephen, you're absolutely right. There's tens of millions, hundreds of millions of these sensors, inverters, EV chargers, IoT devices, line sensors. And each device, no matter how small, represents an opportunity and a risk. And on one hand, these devices enable smarter, real-time decision-making and greater grid flexibility. But on the other hand, they expand the attack surface exponentially and creates a web of entry points for potential threats. And I'll give you a personal example. A couple of years ago, I installed a smart thermostat at home. I'm sure you might even have one in your home.

• 7:15Speaker 01

  And it's been great, you know, I could control the temperature from my phone. It helped me save energy. But then I got curious, you know, about how secure it really was. And after doing a bit of research, I found out that many of our smart home devices, including thermostats, have very basic vulnerabilities that in essence could be exploited by hackers. That hit me, you know, if a single thermostat could be a target, imagine what happens when you multiply that by tens of millions of devices across a power grid. And instead of my home, you know, we're talking about critical infrastructure that supports the entire city. You know, so this means that we can't approach cybersecurity the same way anymore. You know, we, we have to move away from traditional perimeter defenses to adopt a zero trust mindset,

• 8:00Speaker 01

  you know, assuming every device is a potential risk. And, you know, tools like Microsoft Defender for IOT are critical here in providing that level of visibility and protection that's needed to really secure this rapidly expanding IOT ecosystem.

• 8:16Speaker 02

  You mentioned an example, the Colonial Pipeline attack. That was a ransomware attack. You know, it crippled infrastructure. It cut off supplies of gasoline and jet fuel to the southeastern US. What did we learn from that attack in particular?

• 8:33Speaker 01

  You know, that, that was a massive wake-up call for everyone, for everyone, not just within the oil industry and fuel industry, but every industry.

• 8:44Speaker 01

  You know, a ransomware attack on a single company ended up disrupting fuel supplies across the US and the globe. It caused panic buying, price spikes, significant operational disruptions. And I think what it taught us was how interconnected and vulnerable our critical infrastructure really is. You know, an attack on one part of the system doesn't stay contained, you know, it ripples across industries and communities. And the risks are more systemic than ever before. You know, so one of the key takeaways for me was the importance of visibility and monitoring. You know, Colonial Pipeline's inability to isolate and recover quickly showed us

• 9:29Speaker 01

  that many organizations lack the right tools and processes to really handle these sophisticated cyber threats. And even smaller incidents, like in 2020, there was the attack on the Oldsmar Florida Water Treatment Plant. You know, it showed how a single compromised device or this access point can potentially lead to catastrophic outcomes. You know, in that case, attackers tried to manipulate the chemical levels in the water supply. It was the quick action of a single operator that prevented a disaster. So, I mean, I think this reinforces a very, very critical truth that no system is too small or too isolated to be targeted.

• 10:11Speaker 01

  The interconnected nature of our infrastructure means that even minor vulnerabilities can lead to very major disruptions.

• 10:19Speaker 02

  How are regulations evolving right now? Are they keeping up with these threats? And what are the most important standards for risk analysis and security controls in the power sector specifically?

• 10:33Speaker 01

  Anytime regulation comes up, I either get a little woozy or I need a sip of my drink.

• 10:39Speaker 02

  As we all do.

• 10:40Speaker 01

  Yes, yeah. I mean, regulations are certainly trying to keep up with these evolving threats, as we all know. But the other thing is, technology moves very fast, and sometimes legislation and regulation can move slow. So in the power sector, standards like NERC SIP, which is the North American Electric Reliability Corporation's Critical Infrastructure Protection Standards, or the IEC 62443, you know, these are essential frameworks for managing cybersecurity risks. These standards really set the guidelines for everything from risk analysis to access

• 11:21Speaker 01

  controls to incident response, and ends up really forming the backbone of security compliance in the industry. There's other bodies as well, like NIST 2 and some other ISO standards, but primarily speaking, it's those elements. You know, it's achieving that full compliance is often easier said than done as well. My father, who also spent his career in the utility business, he always says that it's one thing to set a rule, and it's another thing to make it work in real life. I think that's what we're seeing to some extent in the utility space. You know, many companies are facing hurdles and meeting some of the compliance requirements because of outdated infrastructure or resource

• 12:03Speaker 01

  constraints, or the lack of trained personnel to implement some of these standards effectively. And then there's elements of noncompliance as well, right? You know, typically, that stems from a few issues. Many utilities are dealing with legacy systems that weren't designed for modern cybersecurity in mind. You know, so to follow a standard that was built in, you know, 10, 15 years ago, where cloud technologies were not being leveraged, and trying to shoehorn that into an environment that exists today is a big challenge. You know, and this is an industry that handles risk very carefully and very surgically,

• 12:43Speaker 01

  I would say. And that could often mean a misinterpretation of some standards, or overclassification of certain components within their ecosystem to be at a higher level of compliance than it needs to be. So I mean, there's many different reasons here in terms of some of the challenges that exist, but ultimately, I think with legacy systems, some legacy standards, you know, the need for more training, more security tools, ongoing monitoring, this creates a very difficult environment around compliance.

• 13:18Speaker 02

  I have worked for both large and small organizations, and within the large organizations, I've done some of the security training and I've watched people around me, you know, skip through it and try to get through it as fast as possible. And so what you're saying is there are probably also human vulnerabilities too. Maybe don't skip that training.

• 13:37Speaker 01

  Absolutely. It's so important. It really is one of the most important things that the entire workforce needs to be very fluent in. These cybersecurity risks exist across the entire ecosystem. You know, the number one focus for these hackers are to, are for them to blend in, for them to be camouflaged, to avoid them being identified before they get entry into systems. So that entry needs to be gated by every single person. Yes, we need security controls, we need tools, we need processes, but every individual who serves within the energy value chain, within the, within that enterprise, needs to be a security champion.

• 14:22Speaker 02

  Okay, so we've sufficiently made people a little nervous, which I think is appropriate for the scale of the threat here, but let's turn our attention to solutions now. Where are some areas where technology is actually staying ahead of the threat or keeping pace with it?

• 14:39Speaker 01

  When I look at Microsoft specifically, I continually get impressed with how much we are doing to drive cybersecurity forward. And the investments that we are putting in to build those new capabilities. You know, our investment over the next five years of $20 billion has led to the development of some of the most advanced cybersecurity tools that exist in the world. Things like Microsoft Security Copilot, for example. You know, this AI-powered cybersecurity assistant enhances threat detection, can analyze vast amounts of data to identify anomalies and potential threats in real time, something that a human would not be able to do.

• 15:24Speaker 01

  And then you can also look at how our, you know, Security Copilot and Microsoft Sentinel, for example, proactively detect and mitigate risks before they escalate. And then you have Microsoft Defender for Cloud, which provides that end-to-end protection and encryption and continuous monitoring. So, I mean, there's so many components to it that need to be taken into consideration. Some of these cutting-edge tools that have been developed and deployed are serving as that primary defense mechanism. The other element is, you know, some of these edge processes that are occurring much more closer to the source, you have to look at leveraging some level of security controls to address or minimize those potential attack vectors, you know.

• 16:09Speaker 01

  So that decentralized approach that IoT or Azure IoT Edge brings is able to respond to those threats very effectively.

• 16:16Speaker 02

  And what about companies that are adopting these technologies, these approaches to stay ahead of the threat? Do you have any particularly good customers or partners that offer a good case study?

• 16:27Speaker 01

  Well, Stephen, I could tell you, but then I'd probably have to kill you. We don't want everyone to know who's using what, but no, I'm just kidding. But in all seriousness, I think one standout example for me is Uniper. You know, Uniper is a leading international energy company based out of Germany. They operate, I think, 22 or 23 gigawatts of power generation capacity across Europe. So they're one of the world's largest power producers, very diversified portfolio, significant number of market transactions. And they've embraced in a very bold cybersecurity strategy,

• 17:11Speaker 01

  one that I feel is cutting edge and kind of industry leading, leveraging generative AI components, leveraging Copilot for Microsoft 365 across their entire workforce, which is a significant milestone in their digital transformation journey. But also by integrating Copilot, they've been able to really empower their employees to work smarter and a more connected and drive collaboration and productivity to new levels. And that strategic move not only streamlined operations, but it also fortified their cybersecurity posture. So it enables them to stay ahead of some of those evolving threats. So I think that proactive type of an approach

• 17:54Speaker 01

  that Uniper really exemplifies, leveraging those cutting edge technologies that can drive innovation, drive higher degrees of resilience, has real tangible impact.

• 18:06Speaker 02

  And what about over the long term? If you think about some of the technologies that you outlined, how are they shaping the long term picture for cybersecurity, particularly in AI?

• 18:20Speaker 01

  Well, when we talk about the future of cybersecurity, I can, I often think about sci fi references. I don't know if you remember the movie Minority Report with Tom Cruise. I think it was sometime in the early 2000s, but it was a great movie, a movie that was very futuristic about a specialized crime unit within a police force that used advanced technologies and psychics to predict crimes before they happen. And I feel like that's kind of what we're building now at Microsoft to take these concepts further with AI and predictive analytics advancing to a point that seemed purely fictional just a few decades ago.

• 19:04Speaker 01

  But it's a major trend moving forward and that we're focusing in on at Microsoft is predictive threat intelligence. So imagine being able to see the digital fingerprints of a potential attack before it's, as it's forming. And you know, our investments in AI specifically like Security Copilot. I mean, this is what allows security teams to analyze huge amounts of global threat data in real time, spotting those patterns, those vulnerabilities that humans alone would just simply miss. Another trend that's on the rise is quantum computing and its implications for cybersecurity. And you know, our Microsoft research team is actively exploring how quantum technologies

• 19:48Speaker 01

  could both enhance encryption and create new challenges as well. So in a few years, quantum encryption could be the standard for protecting data, you know, taking security beyond anything our current systems could could really handle. And lastly, and what we're seeing is a future where cybersecurity becomes fully decentralized. You know, with with the expansion of IOT and edge computing, Microsoft's vision is a world where every connected device has its own layer of protection, you know, kind of creating this sort of self-defending network.

• 20:27Speaker 01

  So really think of it as every device being its own security guard to an extent, you know, able to detect and respond to threats independently, even if it's part of a much larger grid. So I mean, it sounds a little sci-fi in many ways, but these are very real technologies that are shaping the future of cybersecurity and we're starting to to see them momentum and that transformation happen as we think about how we handle and respond to threats on a global scale.

• 20:57Speaker 02

  Your role is to anticipate bad things before they happen. What makes you feel good? If you look at the evolution of process and culture and technology, what makes you feel good about where we're headed?

• 21:13Speaker 01

  There's many things. It's not all doom and gloom, but there are many things that do make me feel confident and and safe moving forward. One, we talked about a lot of the the solutions around more sophisticated AI threat detection tools, the some of the incredible security stack that Microsoft brings to market as well, the investments that we're seeing in R and D. But I think ultimately, what gives me the most level of confidence is I think that we have an alignment that exists across industry that in many cases can be very difficult to try to find in a different circumstance.

• 21:52Speaker 01

  Everybody across the industry, whether you're a CEO, COO, CIO, and other stakeholders like regulatory agencies, research labs, academia, every party, every stakeholder across the energy ecosystem is aligned in on this, that this is a significant risk, that we need to handle this risk in a different way moving forward. And I think what we're seeing more and more going forward is a very sincere willingness to rethink how we approach cybersecurity and to ensure that we work collectively as a team, because it's going to require a broad set of partners and stakeholders to achieve

• 22:37Speaker 01

  some of these outcomes. And there's that commitment across the board to move together and leverage the best of what organizations have to bring and build a more secure, resilient future, leveraging the most sophisticated cybersecurity measures possible.

• 22:53Speaker 02

  Well, Bilal, thank you so much. This was a really helpful look at cybersecurity threats and opportunities in the energy space. Really appreciate it.

• 23:01Speaker 01

  Thank you for having me on and thank you for letting me geek out a bit on cybersecurity. I hope we've inspired some of our listeners to at least change their passwords and if they do that, I'll call this podcast a win.

• 23:19Speaker 00

  Bilal Khashid is the Executive Director of Microsoft's Global Power and Utilities Business. This episode was produced in partnership with Microsoft. To learn more about how Microsoft is working with utilities and other energy companies to create a safe, secure energy transition, go to microsoft.com/industry/energy.