Cybersecurity in energy and natural resources

Safeguarding the tech stack

The CISO’s role in the ENRC sector is no longer confined to the traditional scope of IT security. Indeed, according to KPMG research, 70 percent of ENRC CEOs agree that cybercrime and cyber insecurity will impact organisational prosperity over the next three years.1 With IT and operational technology (OT) converging, CISOs are now tasked with safeguarding the entire technology ecosystem, from the boardroom to the production floor.

This expanded responsibility demands a new set of skills. CISOs must effectively communicate the business impact of cybersecurity to senior leadership, secure adequate budgets, and drive a culture of resilience throughout the organisation. There are signs of positive change in how cybersecurity is becoming more embedded across organisations.

In fact, KPMG research has found that, in 59 percent of ENRC organisations, cybersecurity is typically involved from the earliest planning stages of the decision-making process for technology investment and has a high influence. 2

Cyber security in the energy industry

Sector-specific challenges add to the complexity of the CISO agenda. The ENRC sector is subject to several intricate regulatory requirements around technology, cyber security and the environment, such as NIS2, NERC CIP and the AI Act.

Clearly, CISOs must deliver on compliance while also dealing with the specter of geopolitical challenges and growing cyber-attacks, which can have devastating consequences for the organisation, its stakeholders, and the broader society.

In fact, in April 2024, the North American Electric Reliability Corporation (NERC) said the number of vulnerable US power grid points was increasing at a rate of about 60 per day.3

In Europe, Denmark’s critical infrastructure experienced the largest cyber attack in its history in May 2023, as 22 companies were breached in a matter of days. Some were forced to enter island mode operation by completely disconnecting from the internet.4

To thrive in this environment, CISOs must embrace a proactive and strategic mindset. They need to push vulnerability management back to the business side and lead by emphasising a risk-based approach characterised by strategic guidance on risks, based on their potential organisational impact.

Beyond strategic leadership, a CISO also plays an important role in breaking down the traditional siloes between IT and OT and ensure these teams work together closely to build enduring resilience.

This report explores cybersecurity considerations for the ENRC sector with insights and actionable recommendations. Although not exhaustive, it covers a range of topics that we believe CISOs in the ENRC sector should prioritise in the current environment.

Real-world cybersecurity in ENRC

Proactively identifying risks and developing the capability to recover rapidly from significant cyber incidents remains an area of focus for CISOs in the sector.

Challenge

A KPMG firm was tasked with enhancing a client's capability to recover from a worst-case cyber scenario and developing a tool to help them re-evaluate their most business-critical applications.

The primary objective was to provide the client, an energy distributor, with an extensive playbook featuring detailed processes, procedures, and step-by-step instructions to follow in the event of a complete loss of IT capability.

Additionally, the client needed a method for identifying their most critical business processes.

Response

Collaborating with key global business stakeholders, the KPMG team worked to gain a deep understanding of the client's existing internal recovery processes.

Leveraging KPMG's industry knowledge and experience, the team meticulously populated the playbook with actionable steps for the client to recover their IT systems from zero.

Furthermore, KPMG designed and developed a tool that enabled the client to reclassify their business-critical applications. Over time, the criteria for identifying these applications had become outdated, leading to the misclassification of several non-critical applications as business critical.

The tool assessed various types of data collected in business impact analyses (BIAs) and allowed the client to re-order the criticality of their applications.

Benefit

Through this engagement the client was able to implement processes aimed at reducing downtime and business loss in the event of a total IT capability loss.

Additionally, the client gained a clearer understanding of the criticality of their business applications and processes, ensuring better preparedness and resilience against cyber threats.

Lessons learned

Given the extensive supply chains and interconnected IT and OT systems, security needs to remain top of mind. Rapid adoption without the right guardrails can increase vulnerabilities, making organisations targets for cyberattacks.

However, ENRC organisations clearly are becoming better prepared. They are using AI and machine learning for predictive maintenance and threat detection, blockchain for secure transactions, high-performance computing and IoT for real-time monitoring, and secure-by-design principles for increased security.

Additionally, cloud security solutions and centralised cybersecurity governance can help manage and secure data effectively.