How Strong Authentication Can Help Energy Companies Keep the Lights On

Cyber attacks are ranked the second highest risk for global businesses today — up from 15th on one list just five years ago. This may not come as a shock when you think about how many data breaches we’ve seen in the past few years.

Cyber attacks are ranked the second highest risk for global businesses today — up from 15th on one list just five years ago. This may not come as a shock when you think about how many data breaches we’ve seen in the past few years. While most of these breaches involved stolen credentials and other data, what if hackers turned their attention to power grids? The impact could range from blackouts and disrupted water supplies to hampering other essential services — creating a domino effect. Loss of power could lead to reduced production across other industries like retail and manufacturing, which would severely affect the economy.In other words, cybersecurity is particularly important to the energy industry because, unlike other industries where mainly sensitive data is at stake, cyber threats in the energy space could affect the physical world as well.
Why have cyber attacks in the energy sector accelerated so quickly? In an effort to ‘go digital,’ energy and utility companies have jumped onto the IoT bandwagon to more efficiently connect remote locations and multiple vendors. However, many have struggled to adopt modern security solutions due to heavy infrastructure, legacy IT infrastructure and logistical complications. One effective way energy companies can reduce the risk of cyber attack is to ensure strong authentication mechanisms for authorizing individuals to access systems and facilities.

User Authentication Is Key to Security
The National Cybersecurity Center of Excellence (NCCoE) has described a lack of authentication as a tactical risk in this kind of high-risk environment, now that energy and utility companies have started using mobile and other Internet-connected devices to enhance productivity. This change has resulted in the convergence of operational technologies (OT) and information technologies (IT). OT manages industrial control systems like the power grids, whereas IT manages the networked resources. IT/OT resources are accessed by staff and vendors using Identity and Access Management (IdAM) systems, making IdAM the convergence point of IT and OT.
With this convergence comes challenges. Such challenges include accountability issues, as IdAM systems are fragmented and controlled by several departments. Without a centralized platform that monitors access control to both critical and non-critical assets, it becomes nearly impossible to trace the root cause of attacks and service disruptions.

IdAM Needs Multi-factor Authentication (MFA)
The National Cybersecurity Center of Excellence (NCCoE), which is part of the National Institute of Standards and Technology (NIST), developed an example identity and access management (IdAM) solution, which illustrates examples of technologies that support a converged IdAM platform, as well as provides a high-level reference architecture showing where authentication and access control should be deployed.
The most effective IdAM implementations include MFA as a key component. This is why a part of CIP-005-5 — “Electronic Security Perimeter(s)” of the North American Electric Reliability Corporation (NERC) CIP guidelines — requires multi-factor authentication for all interactive remote access sessions.

Biometrics Make Multi-Factor Authentication More User-Friendly
Going digital, to make services and processes more convenient and efficient for employees, customers and suppliers, is essential for energy companies as they modernize. However, providing access via multi-factor authentication that uses passwords or passcodes can be cumbersome. Biometric authentication technology provides a more streamlined and convenient way to enable more secure employee access to facilities and devices, as well as secure and efficient collaboration with suppliers and partners. Also, as many consumers already use biometrics on smartphones, providing biometric authentication as one way for customers to log in to their accounts is a logical next step.
Data breaches cost energy companies millions per incident. Beyond cost, a major disruption of power or water could compromise our safety and economy. High-assurance strong authentication such as biometrics-based authentication that leverages public key infrastructure (PKI), is a smart addition to security systems to eliminate vulnerabilities and effectively defend against cyber attacks.