Cybersecurity in the energy industry: Why working together across the value chain is vital for resilience

The energy and utility industry has faced more organized cyber attacks with widely reported ramifications. Supply chain attacks are now more visible in number and impact.

In 2021 alone, SolarWinds, as a single attack, impacted thousands of top companies and government agencies worldwide. Meanwhile, the Colonial Pipeline attack crippled the energy supply to millions of citizens for a few days, cost millions to contain and recover, and caused long-term brand damage.

With the knowledge that during 66% of the incidents, attackers focused on the suppliers’ code to further compromise targeted customers and that an entire value chain can be brought to its knees due to a single organization’s weakness or vulnerability, the questions you need to ask are:

No organisation can go alone in our interconnected world, and trust is necessary. It is also a dilemma as trust itself can become a vulnerability if it is not thoughtful, reciprocal and verifiable on evidence.

Practically, every government agency, non-profit organization, global conglomerate and small and medium-sized business relies digitally on a supplier or partner to operate. Each has no choice but to overcome the asymmetry of information.

Still, when ones operate an “enabling function” that is integral to growth and production across a nation, it has to guarantee trust through action all along the value chain.

Operating in multiple locations, sourcing goods from five continents, outsourcing services and managing thousands of unique suppliers is a reality for companies from the energy sector.

On top of that, the energy sector relies heavily on data that help create a reliable and flexible energy infrastructure. The supporting technologies usually come from third parties. This increases the complexity and the risk over their landscape.

It is even more complicated when we know that 65% of organizations have not identified the third parties whose compromise could impact their most critical functions.

To take a risk-informed approach, companies should build “third-party security principles” that govern how they engage suppliers on a common cybersecurity posture so that security and privacy are embedded in the procurement process and supplier life cycle. These could include:

Guiding principles must govern third-party security to mitigate the risk stemming from suppliers but also create transparent conversations on security.

In a complex value chain, energy companies are the supplier of a customer or a user. Hence, each must certify that security is an upmost priority and reality for the company.

Markers of trust should thus be the backbone of a cyber strategy which guide the design and delivery process security, as outlined below.

From the most basic up to the most tangible evidence, each marker raises the level of confidence and allows trustworthy discussions when engaging with clients and authorities.

Each interaction with a customer counts, and this is critical that cybersecurity is part of the discussion from sales up to the chief information security officer (CISO) level.

Customers must have the assurance that the highest security standards are met when visiting their site, submitting cyber questionnaires and being informed of vulnerabilities. Here's how you can do that:

The energy sector is the cornerstone of our economies: all our daily operations depend on the development and transport of energy. Hitting its value chain with a cyber attack is a concrete way to cripple an economy and destabilize national security.

In an uncertain environment and dynamic cyber threat landscape where energy sector is a target for adversaries, building trust within the value chain is a must.

We will collectively mitigate systemic risks and achieve greater resilience if global leaders collaborate and engage personal based on shared understanding.