Cybersecurity considerations 2024: Energy and natural resources sector

Complexity of jurisdictions – In many cases, countries, territories and jurisdictions have different regulatory frameworks for cybersecurity. While some regulations aim for a more unified approach, such as what the Network and Information Security Directive (NIS2) attempts to do in the European Union (EU), some other areas are more locally focused, leading to diverse interpretations of regulations. This added regulatory complexity challenges organizations in this sector to comply with global or regional standards while also dealing with local requirements.

Grid stability and increased attack surface – As the energy sector becomes more interconnected globally, the attack surface for cyber threats expands. Integrating various systems and networks across borders provides more entry points for cybercriminals, challenging grid stability in an interconnected cross-border energy network.

Cyber extends over boundaries – Cyber threats do not adhere to geopolitical boundaries. A cyberattack originating in one country can easily impact critical infrastructure in another. Coordinating responses and attributing attacks in this environment is complicated.

Legal restrictions in information sharing – While collaboration and information sharing are crucial for effective cybersecurity, regulatory, legal, political and competitive concerns around sharing sensitive information across borders can hinder effective threat intelligence sharing.

Ongoing politicization of business – The energy and natural resources sector is prone to the entanglement of business/economic activities with political interests, agendas and influences. Geopolitical tensions often result in increased cyber threats, especially targeting critical infrastructures. As a critical infrastructure sector, energy is a prime target for rogue and state-sponsored cyberattacks, with potential consequences for both the supply chain and end consumers.

Collaboration– The global nature of the energy sector provides opportunities for joint cybersecurity efforts. Sharing threat intelligence, industry best practices, and lessons learned internationally can enhance companies’ overall security posture.

Standardization – Globalization can drive efforts to establish international standards and best practices for cybersecurity in the energy sector. Normalization of rules and regulations can simplify the implementation of security measures across supply chains and borders.

Innovation – Cross-border cooperation can foster the development of advanced cybersecurity solutions that can potentially benefit the entire industry.

Agility – With global communication networks, incident response teams can work together in real time, enabling faster and more effective responses to cyber threats. This can minimize the impact of attacks on critical infrastructure.

Supply chain complexity and dependency – The global nature of the energy and natural resources sector involves complex supply chains on which the sector is heavily dependent. This ecosystem of multiple levels of stakeholders, vendors and technology providers makes it nearly impossible to maintain visibility into and control of all parties, substantially increasing the cyber risks.

New versus old technology – Energy companies often rely on a mix of both old and new information (IT) and operational technology (OT). Adopting networked technologies adds complexity and introduces new interdependencies and potential vulnerabilities. OT systems generally have a longer lifespan and lifecycle than IT systems, and older technologies often do not have adequate security capabilities relative to newer technologies. The bottom line, integrating diverse technological landscapes (i.e., old and new) and the corresponding security measures is challenging — and is further complicated by ongoing digitalization.

The weakest link – The potential for cascading impacts across the supply chain when there are different levels of cybersecurity maturity among operators and suppliers throughout the chain can create weak links. There is a dependency on the due diligence of third parties — an inadequately secure supply chain partner also impacts your security posture. It can be challenging to keep track of the cybersecurity posture and measures of all the vendors and partners an organization is linked to in the ecosystem.

Digitalization – In an evolving energy market, the transition toward green energy and changing customer demands on suppliers requires organizations to digitalize and innovate. At the same time, adopting new technologies also raises concerns for the security implications of adopting these new technologies.

Transparency and collaboration – Managing cybersecurity risks associated with third-party vendors, including assessing their security practices, can be challenging, but the interdependency will likely force organizations to seek transparency and collaboration. Transparency of security posture and measures, data breaches and vulnerabilities creates a culture where weaknesses are identified and can be addressed proactively and collectively, making it possible to eliminate weak supply chain links.

Information sharing – Collaborative efforts across the energy sector can also take the form of shared threat intelligence and best practices among stakeholders, which can lead to collective improvements in cyber threat defense.

Visibility and innovation – Integrating new technologies into the supply chain can enhance operational efficiencies but will also enable companies to improve their visibility and monitoring capabilities. This can lead to better incident detection and resilience while mitigating cybersecurity risks, thereby strengthening supply chain security.

Operational resilience – Organizations in the sector are very familiar with ensuring high levels of operational execution and resilience as they deliver critical services and any disruptions can have a significant impact. Companies must realize that not only is their IT the target of cyberattacks, but also their industrial environments and the enterprise as a whole. Cyber resiliency will require organizations to shift their thinking to activate new capabilities and security measures.

Complexity of industrial environments – Industrial environments such as energy/power, storage and renewables are among the most complex infrastructure types and play an important role as the backbone of societal and economic activity. Lacking full understanding of the functions, interconnectedness and dependencies of all systems can hinder resiliency efforts.

Supply chain resilience – The deep dependence on third-, fourth- and even fifth-party supply chain partners among energy and natural resources companies make incident recovery and overall resilience particularly difficult.

Threat landscape – The ever-expanding threat landscape requires these organizations to continuously evaluate and update their defense and response plans to ensure they remain effective against changing and advancing threats.

Trust and reputation – Maintaining customer trust is critical for security professionals in the energy sector. Cyber incidents not only disrupt operations but also erode customer confidence. Managing the impact on customer trust and reputation requires a proactive and transparent approach to cybersecurity.

Perspective – Resilience involves a more comprehensive understanding and management of risks, including not only cybersecurity threats but also other factors that could disrupt operations. This holistic approach helps organizations adopt a different way of thinking and identify a broader range of risks.

Adaptability – Being adaptable and responsive to changes in the threat landscape, advances in technology and developments in the business environment are the hallmarks of resilience. It positions energy companies to stay ahead of emerging challenges and quickly adjust and adopt new cybersecurity and operational strategies and capabilities, such as improved detection and monitoring.

Collaboration – Resilience initiatives often involve collaboration with partners in other industries. Establishing strong partnerships and sharing information across sectors enhances collective preparedness and response capabilities.

Compliance – A resilience-focused approach not only helps organizations meet cybersecurity regulations but also positions them to address broader compliance requirements related to business continuity, disaster recovery and overall risk management.