By: Allison Duke, CPA, and Mohamad Al-Kawafha, CPA
Regulatory compliance must be a top priority for energy companies. It’s legally required, for one thing, and the consequences of noncompliance pose an unacceptable risk to your organization. But it’s important to recognize the limits, too: Regulatory compliance won’t keep your organization safe from cyber threats.
Regulatory compliance alone is not enough to protect against Ransomware-as-a-Service (RaaS), State-Sponsored Advanced Persistent Threats (APTs), Living off the Land (LotL) attacks, or other malicious activities that compromise your company’s cybersecurity. Here’s what you need to know:
Cybersecurity Blind Spots
Cybersecurity audits can be a hassle for organizations in the energy sector, without a doubt. But, seeing them as a bureaucratic hurdle that guarantees safety once you’ve completed them is a dangerous mistake.
Meeting the minimum standards set by regulatory frameworks represents just a single facet of a comprehensive cybersecurity strategy that’s robust enough to effectively mitigate cyber risk. For energy companies, the relevant frameworks include:
- North American Electric Reliability Corporation Critical Infrastructure Protection (NERC-CIP)
- National Institute of Standards and Technology Critical Security Framework (NIST CSF)
- TSA Security Directives for pipelines
- Federal Information Security Modernization Act (FISMA) for federally controlled energy organizations
Treating these frameworks as a series of checklists that add up to cybersecurity can create a false sense of security. That approach frequently causes leaders to overlook blind spots — risks that the regulatory framework either doesn’t address at all, doesn’t effectively mitigate, or doesn’t recognize because of the time lag between regulatory updates and real-world cyber risks.
Sometimes the blind spot lies outside the regulatory scope, as with third-party vendor access to your company’s systems and data. Internet of Things (IoT) devices that lack proper security and management pose another significant risk that regulatory compliance won’t fully resolve.
And, while compliance with all applicable frameworks is helpful, it ignores how your systems interact with each other. Your business operations may involve multiple systems that are 100% compliant individually. Even so, the way they’re linked together can still leave a massive structural vulnerability.
Worst Case Scenarios
When you’ve met the minimum regulatory standards for cybersecurity and put high-tech solutions in place, you may feel confident about your overall security posture. But little things can still cause huge problems, as in the Colonial Pipeline attack.
A single leaked password on an old, unprotected VPN account that lacked multi-factor authentication shut down the largest fuel pipeline in the U.S. It wasn’t a failure of core operational technology that allowed this disaster to happen, but a failure of basic IT security that bled into operational decision-making.
It was Industroyer (aka CrashOverride) malware, targeted at electrical grids in particular, that powered a high-profile 2016 incident. Hackers took control of SCADA systems to open circuit breakers using Industroyer. That move cut power to hundreds of thousands of people relying on Ukrainian energy grids. The attackers then took it a step further by wiping system logs, which delayed the recovery process. This incident was a wake-up call to energy leaders and clearly illustrates what can happen when bad actors understand the operational environment better than those attempting to defend it.
Adopt a More Protective Security Stance
Protecting your company in this aggressive threat environment demands a more sophisticated approach than the checkbox mentality. Energy leaders must shift from a compliance-driven model to a risk-driven model that treats compliance as the floor, not the ceiling. If you’d like to discuss how these issues could affect your business, our team would welcome the conversation.
