Building resilient energy supplies

Energy security expert at The NATO Energy Security Centre of Excellence, Tadas Jakštas discusses the threat posed by cyber terrorists to the functioning of Europe’s electricity network.

The energy security expert serves as an adviser on all aspects of regional energy resilience. His main expertise is on kinetic and non-kinetic threats to energy supplies, the protection of critical energy infrastructure, and resilience.

According to Jakštas, cyber threats and attacks to the world’s energy supply network are becoming more common, sophisticated and damaging. As a result, NATO needs to be prepared to defend its networks and operations against the growing sophistication of the cyber threats and attacks it faces.

He adds that the disruption of energy supply could affect the security of societies and, while these issues are primarily the responsibility of national governments, NATO continues to consult on energy security and further develop the organisation’s capacity to contribute to energy security, concentrating on areas where it can add value.

Referencing the successful attack on parts of Ukraine’s national electricity grid back in 2015, Jakštas highlights that cyber terrorists are developing their skills at a rate comparable to, or even superior to, the speed at which national governments are implementing their energy digitalisation policies.

“There is no such thing as 100 per cent prevention, where these matters are concerned. The best hope for society as a whole is that the likes of the European Union can mitigate risks in the most effective way possible.

“Achieving this will require a greater understanding of the cyber ecosystem: how it works and being able to measure the level of threat posed by the people, processes and products involved in data security.”

Jakštas describes the need for greater civil and military co-operation when it comes to keeping the cyber terrorists at bay, describing the shift from physical combat to a small group of highly trained IT experts hacking in to an enemy state’s energy networks.

According to Jakštas, cyber attacks against critical energy infrastructures can have cascading effects. This is because other critical infrastructures are heavily dependent on stable energy supplies.

“Resilient energy supplies are critical for the enablement of military reinforcements. Any disruption of communications impacts on the ability of any country to deploy or sustain its forces,” he adds.

Resilience

The NATO official outlines that cyber resilience requires the identification of those assets which must be protected.

“There is also a requirement to understand the operational landscape and understand the cyber ecosystem,” he says. “But underpinning all of this is the necessity of having a grid network that is fully functional on a 24/7 basis. It is against this continuing backdrop that the growing threat of cyber-crime must be assessed.”

Jakštas profiles the significance of NATO’s Energy Security Centre of Excellence (ENSEC COE). The organisation provides technical, scientific and academic subject matter expertise in the field of energy security that contributes to risk assessment analysis. It also acts to identify future needs in NATO transformation activities while seeking to prevent or mitigate emergent military threats and challenges, which result from the global scarcity of energy resources.

He confirms the new and emerging threat of cyber-attacks on the operational technology (OT) within industrial controls systems, specifically pointing out that the threat to the OT protection of key national resources, such as nuclear power plants, is significant.

Fundamental problems can arise in this context as an IT-based system is directly interfacing with physical processes. If these systems are in any way altered, the end result could be physical damage to the infrastructure targeted.

“Complete cyber defence will be an impossible goal to achieve. This is because cyber threats are constantly changing. Cyber resilience should focus on an ability to prepare for and adapt to ever changing conditions, while withstanding and recovering rapidly from disruptions.

“We must also develop the ability to restore regular delivery mechanisms after a cyber attack,” he concludes.