In the past year, FirstEnergy Pennsylvania has seen a growing number of attempted malware and cyberattacks around their critical infrastructure.
“Our defensive systems block tens of thousands of automated malicious connection attempts against public facing services each month,” said Brian Harrell, the chief security officer at the company that serves 2.1 million electric customers across 56 counties in Pennsylvania. “These statistics underscore why cybersecurity requires constant attention and continual enhancement.”
He was speaking to a panel of Pennsylvania House members about the increased cybersecurity threats utilities across the state are facing.
In the last few years, criminal and state-sponsored actors have increasingly targeted critical infrastructure across America and Europe. And as utilities and grid infrastructure increasingly rely on internet connections to function, bad actors’ tools have become more sophisticated.
“They’re seeking to manipulate, disrupt or disable the very control systems that provide light, heat and clean water for our communities,” said Rep. Pat Gallagher (D-Philadelphia), chair of the House Consumer Protection, Technology and Utilities Committee’s subcommittee on utilities. “Protecting our public utilities requires a unified front, one that bridges private operators, public regulators, state agencies and both political parties.”
Utility executives and cybersecurity experts agreed that, at this point, investments in cybersecurity have become nearly as necessary as spending on infrastructures. But they warned lawmakers they come at a cost to ratepayers, and asked for any new regulations or requirements to take that into account.
“These investments are necessary, but cybersecurity now competes for the same limited resources needed for pipes, pumps and capital improvements,” said Craig Fahnestock, the director of government relations for the Pennsylvania Municipal Authorities Association. “We’re asking for requirements that are achievable.”
Fahnestock’s group represents nearly 700 municipal water authorities. Many are on the smaller side, serving rural communities, and don’t have the money of their counterparts in larger cities.
“All of them are working to address it, but their resources vary considerably,” he said.
While lawmakers were not discussing any particular legislation, Fahnestock asked that any new law implementing cybersecurity requirements include funding, or that the state otherwise help connect smaller authorities with technical experts.
Samit Nair, the Chief Information Officer for Essential Utilities, the parent company of Aqua Pennsylvania and People’s Natural Gas, said his company has managed to ward off any significant cyberattack, in part through funding cybersecurity initiatives.
“We treat cybersecurity spending as a normal, prudent part of running safe and reliable utility operations, the same way we treat the investment in pipes, treatment plants and distribution infrastructure,” he said.
While Nair said the company has not experienced any incidents that have disrupted operations, interrupted service to customers or caused a “material financial impact,” that doesn’t mean increased cybersecurity threats haven’t cost them.
The company requires cybersecurity insurance. And the costs can vary depending on a firm’s track record.
“The premium rates, a lot of it depends on how solid your practice is,” he told lawmakers. “So there’s a whole bunch of questions that insurers ask us, and validate us, before they even provide us insurance.”
Jeremy Young, president and CEO of Federal Resources Corporation, an organization that provides cybersecurity expertise to government and public sector organizations, warned lawmakers that artificial intelligence has only increased the cybersecurity needs of utilities.
“Attackers now have access to automation and artificial intelligence that can accelerate reconnaissance, phishing, vulnerability, discovery and exploitation,” he said. “A utility may have thousands of employees, devices, applications, identities, suppliers, systems and vulnerabilities to protect. An attacker only needs one successful path.”
While he stressed defense against cyberattacks required action, he also warned against legislation that’s too prescriptive in a quickly changing environment.
“A security control that worked when it was audited six months ago may not be working today,” he said. “That’s why I believe cybersecurity needs to become a continuous risk management discipline rather than a periodic compliance exercise.”
He encouraged lawmakers and state regulators to focus on regulations that require risk monitoring and taking proactive cybersecurity measures, but that allow utilities to decide what works best for them and their ratepayers, who often foot the bill for new spending requirements.
“I believe we should give utilities flexibility in how they achieve cybersecurity outcomes while requiring evidence that those outcomes are being achieved,” he said. “Because ultimately the question for this committee and PA ratepayers should not simply be, ‘How much did we spend on cybersecurity?’ It should be, ‘Are Pennsylvanians safer because of it?’”
Young also noted that better cybersecurity doesn’t always require big spending. He said a large majority of cybersecurity incidents can be avoided by educating staff on how to detect and avoid threats, like phishing.
Steve McElwee, the chief security officer at PJM, which operates a massive electric grid across Pennsylvania and 12 other states, also warned lawmakers that changes in power usage from things like data centers have opened electric companies up to greater threats of cyberattacks.
“As electricity demand grows and supply becomes more scarce, the power grid has less flexibility to absorb the impacts of disruptive events,” he said. “In addition, the growth of large computational loads has changed the grid operating conditions, creating challenges like over-voltage, over-frequency and oscillating conditions.”
Harrell, the Chief Security Officer at FirstEnergy also asked lawmakers to consider a particular weak point when crafting bills or regulations.
Electric utilities, he said, are subject to federal cybersecurity regulations and increased scrutiny as cyberattacks on critical infrastructure have become more common. But the companies they do business with, who may have data on their systems and customers, are just as vulnerable to attack.
“While we have done a really good job at defending ourselves, it’s the third party supply chain, it’s our vendors, that may have your data, our data, and customer data,” he said. “We need to be just as sharp with them in ensuring that they are doing what they say they have done.”
