The UK energy sector faces an expanding OT threat landscape

Critical infrastructure is under attack in almost every country, but especially in the United Kingdom. The UK was the most attacked country in Europe, which is already the region most impacted by cyber incidents. The energy industry is taking the brunt of those cyberattacks, according to IBM’s X-Force Threat Intelligence Index 2024.

The energy sector is a favorite target for threat actors. The complexity of systems and the reliance on legacy OT systems make them easy prey. Because of the critical nature of these systems, threat actors know that ransoms will be paid to keep downtime to a minimum.

A changing threat landscape

Ransomware is the top threat to the UK’s critical infrastructure, according to the National Cyber Security Centre (NCSC). While some companies are hit with malware attacks directly, there is increasing risk to the OT supply chain, as suppliers and smaller companies that support energy and utilities are more likely to be victims of a cyberattack. These suppliers often lack good cybersecurity programs, making them an easy target for infiltrating larger critical infrastructure organizations.

The war in Ukraine has elevated the risk to the UK’s energy industry. The conflict has emboldened state-related threat actors, and the NCSC warned that the most significant threat to the critical infrastructure is malware launched by nation-state groups. The goal of these threat actors is disruption of operation, which can have a severe impact on the populations that critical infrastructure serves.

Read the Threat Intelligence Index report

Why the UK is Europe’s top target

The UK is the headquarters of several of the world’s biggest energy companies and is considered a major operations point for many more. These companies include:

• British Petroleum (BP)
• Royal Dutch Shell
• Chevron
• TotalEnergies
• NationalGrid
• Drax Group
• Energy One.

An attack on any of these companies could have a national or global impact. For example, when Australian company Energy One was hit with a cyberattack last year, it also impacted systems across the UK. NationalGrid has reported several near misses — cyberattacks that could have done serious damage to the electric grid, but either cyber criminals missed their mark or the cybersecurity systems did their job to keep the lights on in the UK.

However, threat actors are busy. UK intelligence agencies have discovered active forums and dark web sites sharing information on how to access organizations across the energy and utilities industry. While some are looking at how to get into corporate systems, a growing number of cyber criminals are more interested in accessing the OT systems of the energy sector.

How OT impacts cybersecurity

OT presents a different cybersecurity challenge from IT systems. Traditionally, most OT systems across the energy industry were stand-alone, unconnected from the internet and other systems. However, as infrastructure grows more complex, vulnerabilities are increasing and adding new threat layers —  particularly in the software supply chain. Adding to the problem are the legacy systems in OT, with firmware that can’t be updated or hardware that can’t be replaced without reducing efficiency.

As a result, this sets up a catch-22 for the energy industry: How do you continue to use legacy systems while cybersecurity threats against the energy sector are on the rise?

It starts with knowing your exposure, according to the IBM report. Implementing zero trust and least privilege frameworks will limit access and misuse of credentials. But chances are there are credentials already available on the dark web, so it is necessary to use dark web capabilities to find credentials at risk, identify leaked identities and check social media networks sharing unauthorized information.

Most importantly, the energy industry needs to prioritize cybersecurity across critical systems. Threat actors will continue to take advantage of weak OT systems and an uncertain global outlook, especially as war rages in Europe. Nation-state actors want to take down the critical infrastructure in the countries they see as enemies, and as the UK is home to many of the world’s largest and most important energy companies, it will remain at high risk.

Continue Reading