Cyber threats are pervasive, growing, and real, whether an individual is dealing with them professionally as a Cyber Security Practitioner (CSP) or has been touched by cybercrime in his or her personal life. In today’s “cybersociety,” with globally connected cultures, zeros and ones are the new currency, or “virtual currency.” Cyberspace has become a powerful component of our society with a new set of challenges, which threaten our privacy, way of life, and global security. A very significant global and national question is: how can nation states effectively safeguard their Critical Infrastructure (CI) sectors and provide a comfort factor to their citizens that the CI sectors are secure in an era of insecurity, multiple cyberattacks, and global challenges?

Our society is highly reliant on the energy sector, and this dependency has created numerous cybersecurity challenges as cybercriminals, hackers, and insiders constantly threaten to compromise the virtual currency of the energy sector. Cyberattacks such as Advanced Persistent Threats (APTs), phishing, etc., are on the rise and they are genuine. Companies within the energy sector face the challenges of combating these attacks.

One of the key vulnerabilities in the energy sector is its dependency upon industrial control systems (ICS). A subgroup of ICS, Supervisory Control and Data Acquisition (SCADA) systems, are used in industrial management environments. For the past several decades SCADA systems have been tasked to monitor and control various industrial processes that are too difficult for humans to monitor and/or control. The Distributed Network Protocol version 3 (DNP3) is the current standard used by Supervisory SCADA equipment provides for some data integrity; however security is largely non-existent for this protocol. DNP3 was designed with little security methods in mind, so the protocol itself lacks any form of authentication, and this deficiency of authentication is one factor that contributes to security risks within the energy sector.

There is no “perfect” solution for combating the cyberattacks deployed against the energy sector, but many standard bodies have begun developing best practice expectations for companies operating in the sector. Prominent guidelines have now been released by both the National Institute of Standards and Technology (NIST) in the U.S., and the European Commission in the EU. Implementing these countermeasures helps companies in the sector defend against the next generation of threats, such as Stuxnet and Flame. It also helps organizations demonstrate an adequate level of care to regulators. However, appropriate implementation requires an intelligent security model, which includes a multi-faceted approach to governance and compliance.