# Guarding the Grid: Hackers Target Smarter Power System

An episode of [Switched On](https://invisiblenetwork.ai/podcast/1469286286), 14 Dec 2023, 27 min.

Audio: https://podtrac.com/pts/redirect.mp3/traffic.omny.fm/d/clips/e73c998e-6e60-432f-8610-ae210140c5b1/01a10738-3608-4dec-883c-ae3c00026b36/c7388ba9-4a4b-4d23-b7aa-b0d800afb688/audio.mp3?utm_source=Podcast&in_playlist=6d114f63-833d-4b78-bbf5-ae3c00026b44

As power grids evolve to accommodate new clean energy sources and smart technology, they are becoming more vulnerable to cyberattackers looking to exploit weaknesses in these increasingly connected systems. But what form do these attacks take, and what can be done to prevent them in the first place? On today’s show, Dana sits down with Amanda Ahl from BloombergNEF’s grids and utilities team. Together they discuss what form a cyberattack on the grid can take and the scale of damage it can cause, the marketplace for cybersecurity and costs involved in securing networks, and how utilities can future-proof their infrastructure against new artificial intelligence and quantum computing threats. Complimentary BNEF research on the trends driving the transition to a lower-carbon economy can be found at BNEF<GO> on the Bloomberg Terminal, on bnef.com or on the BNEF mobile app. Links to research notes from this episode: Guarding the Grid: Utilities Fortify Cyber Defenses - https://www.bnef.com/insights/32631 See omnystudio.com/listener for privacy information.

## Transcript

[0:00] Speaker 1: This is Dana Perkins, and you're listening to Switched on
[0:03] Speaker 1: the BNF podcast.
[0:05] Speaker 2: Now.
[0:05] Speaker 1: I don't know about you, but it seems like all
[0:07] Speaker 1: of my friends are talking about AI lately. And among
[0:10] Speaker 1: the myriad of things to consider is cybersecurity. It's such
[0:13] Speaker 1: a hot topic, in fact, that it was even featured
[0:16] Speaker 1: in the most recent Mission Impossible film. But cybersecurity is
[0:19] Speaker 1: not a new topic, as will come to find, as
[0:22] Speaker 1: much of the world has an increasingly complex grid that
[0:25] Speaker 1: has evolved to become even smarter and more digital and
[0:28] Speaker 1: capable of optimizing energy use, which will prove helpful in
[0:31] Speaker 1: the race to net zero. These very additions themselves have
[0:35] Speaker 1: created new vulnerabilities which cyber attackers can exploit. So what
[0:40] Speaker 1: sort of damage can be caused by a cyber attack
[0:42] Speaker 1: on electric utility and can we protect them? And what
[0:45] Speaker 1: exactly is an air gapps. It's a computer or network
[0:49] Speaker 1: which is isolated from other networks for security reasons. Today,
[0:54] Speaker 1: instead of me telling you any more about it, I'm
[0:55] Speaker 1: joined by our Grids and Utilities team member Amanda al
[0:59] Speaker 1: She's going to discuss some of the findings from her
[1:01] Speaker 1: recent report called Guarding the Grid Utilities Fortify cyber defenses. Together,
[1:07] Speaker 1: we discuss the different forms a cyber attack can take,
[1:10] Speaker 1: the motivations behind these attacks, and the scale of damage
[1:13] Speaker 1: that can be caused, as well as the costs involved
[1:16] Speaker 1: in fixing them, and to ward off attacks. Can anything
[1:19] Speaker 1: be done at the government level to beef up cybersecurity.
[1:23] Speaker 1: We assess some of the policies countries have put in
[1:25] Speaker 1: place to strengthen cybersecurity in both the public and private sectors,
[1:30] Speaker 1: and the marketplace for companies offering grid security. And finally,
[1:34] Speaker 1: what does the future of grid security look like? As
[1:37] Speaker 1: we enter an era of AI and quantum computing with
[1:40] Speaker 1: even greater computing capabilities, also comes some potential threats and
[1:45] Speaker 1: are there measures that can be put in place to
[1:47] Speaker 1: combat these even more complex attacks. To access Amanda's report,
[1:51] Speaker 1: BADF subscribers can find it at BNF dot com, on
[1:55] Speaker 1: benf Go, on the Bloomberg terminal, or on the BNF
[1:57] Speaker 1: mobile app. If you like this podcast, make sure to
[2:00] Speaker 1: subscribe and you'll receive an update when a future episode
[2:03] Speaker 1: is published. And if you give us a review or
[2:05] Speaker 1: a rating on Apple Podcasts or Spotify, it'll make us
[2:08] Speaker 1: more discoverable by others. But right now, let's jump into
[2:11] Speaker 1: our conversation with Amanda. Amanda, thank you very much for
[2:24] Speaker 1: joining switched on today.
[2:25] Speaker 2: Thanks for having me.
[2:27] Speaker 1: So today we're going to talk about grid security. What's
[2:29] Speaker 1: at stake here? What is the worst case scenario?
[2:32] Speaker 2: So, I mean utilities are really integrating more and more
[2:37] Speaker 2: digital technologies, meaning that they're investing in more technologies like
[2:41] Speaker 2: sensors and creating digital models of the grid and investing
[2:46] Speaker 2: in communication technologies. And as they do that, it means
[2:50] Speaker 2: that first of all, the grid is getting the eyes,
[2:52] Speaker 2: the brain, and the sense that it needs to act efficiently.
[2:55] Speaker 2: By at the same time, integrating all these new technologies
[2:59] Speaker 2: which have in at access means that it's increasing the
[3:02] Speaker 2: potential cyber attack service of the power system. And with
[3:07] Speaker 2: this new link with the Internet, it basically means that
[3:10] Speaker 2: cyber thread actors could potentially access physical grid infrastructure, leading
[3:15] Speaker 2: to damages, leading even to power outages.
[3:18] Speaker 1: So we're most concerned about blackouts maybe citywide, statewide, Like
[3:23] Speaker 1: what scale would the worst case scenario be? And I
[3:26] Speaker 1: guess the follow on to that is really how connected
[3:29] Speaker 1: is it? Is it all of the grids across the US,
[3:31] Speaker 1: barring or cut that are all connected. You know how
[3:35] Speaker 1: big could a problem be if there was a cyber
[3:38] Speaker 1: attack they got in If we're specifically focused for this
[3:41] Speaker 1: question on power outages.
[3:43] Speaker 2: I mean, that's really hard to say, because what we
[3:45] Speaker 2: know right now is that there is malware out there
[3:48] Speaker 2: that could specifically target technologies on the grid, like substations
[3:53] Speaker 2: or other kind of operational technologies. So I mean, hypothetically
[3:57] Speaker 2: a cyber attack could maybe take out and an ore
[4:00] Speaker 2: utilities network. Hypothetically, I'm just saying, but I mean, of course,
[4:06] Speaker 2: utilities are investing in new cybersecurity technologies to make sure
[4:09] Speaker 2: that doesn't happen. But potentially the more and moral malware
[4:12] Speaker 2: coming out that can target power systems means that this
[4:16] Speaker 2: could lead to outages across utilities.
[4:19] Speaker 1: So outages and then you also reference the damage to equipment.
[4:22] Speaker 1: So is that one way of targeting or using malware
[4:26] Speaker 1: is to actually cause maybe a piece of equipment to
[4:28] Speaker 1: malfunction and to actually cause very expensive damage to critical infrastructure.
[4:34] Speaker 2: Yeah, exactly. So there's one example. There's a kind of
[4:38] Speaker 2: malware called crash override, also known as in destroyer. I
[4:43] Speaker 2: love these names that're kind of funny, but what they
[4:44] Speaker 2: do is really not funny. For example, crash override was
[4:48] Speaker 2: used actually used in an attack on Ukraine's grid in
[4:52] Speaker 2: twenty sixteen. And this malware basically took and codified, meaning
[4:57] Speaker 2: put into code knowledge of how control systems work, so
[5:00] Speaker 2: the control system for substations, how they work, and then
[5:03] Speaker 2: use this to shut down the substation in Kiev. And
[5:07] Speaker 2: this was one substation. But the scary thing is that
[5:10] Speaker 2: cybersecurity professionals here thing that this could have been a
[5:13] Speaker 2: proof of concept since not all of this malwar's functions
[5:16] Speaker 2: were used. So if this is not on a larger scale,
[5:19] Speaker 2: it can really damage the grid and of course impact
[5:22] Speaker 2: people that depend on electricity.
[5:24] Speaker 1: So let's talk a little bit about the olden days
[5:27] Speaker 1: when the grid was not connected and things were much simpler.
[5:30] Speaker 1: Technology hasn't just spreaded immediately. Over time, systems have gotten
[5:35] Speaker 1: more sophisticated, and there used to be security measures built
[5:39] Speaker 1: into the way that it was designed. Can you talk
[5:41] Speaker 1: a little bit about how the grid used to be
[5:43] Speaker 1: designed and really what precipitated such a dramatic change to
[5:47] Speaker 1: make everything interconnected.
[5:49] Speaker 2: I mean, originally the text structure of the grid or
[5:52] Speaker 2: the digital tech structure of the grid was based on
[5:54] Speaker 2: two main elements so it's informational technology and operational technology
[5:59] Speaker 2: or IT and OT, so for IT think things like
[6:01] Speaker 2: file management, emails, internet, and for OT. These are the
[6:06] Speaker 2: technologies that monitor and physically control power equipment on the grid,
[6:10] Speaker 2: like substations. And originally these were kept separate because you know,
[6:13] Speaker 2: if OT, like a substation or circuit breakers on the
[6:16] Speaker 2: grid were compromised, then it could result in power outages.
[6:20] Speaker 2: So keeping IT and OT separate was the OG, like
[6:24] Speaker 2: the original kind of cybersecurity mechanism for the power system
[6:27] Speaker 2: to ensure a hack in it would not impact the
[6:31] Speaker 2: physical grid. But I mean now we're seeing utilities are
[6:34] Speaker 2: digitalizing at a rapid pace. And what I mean by
[6:37] Speaker 2: digitalizing is that, as mentioned earlier, the grid is integrated
[6:42] Speaker 2: news technologies like sensors and analytics software to access and
[6:46] Speaker 2: analyze data from the power system to help run this
[6:49] Speaker 2: physical infrastructure more efficiently. So this is great, you know
[6:52] Speaker 2: if you think about efficiency, But this also means we're
[6:55] Speaker 2: integrating IT and OT. So with this new link between
[6:58] Speaker 2: information technology and operational technology, if a cyber thread actor
[7:03] Speaker 2: hacks into an IT system, you know a simple thing
[7:05] Speaker 2: like a phishing email, it might be able to move
[7:07] Speaker 2: laterally and access ot networks and really cause damage to
[7:11] Speaker 2: the grid like we've been seeing.
[7:13] Speaker 1: So we talked a little bit about the olden days
[7:15] Speaker 1: of the grid when things weren't as interconnected, and there
[7:18] Speaker 1: is some brilliance in that simplicity in that.
[7:22] Speaker 2: Is there a.
[7:22] Speaker 1: Move to in some way make these grids a little
[7:25] Speaker 1: bit isolated from one another to actually minimize the risk.
[7:29] Speaker 1: I know that there's a lot to gain in terms
[7:32] Speaker 1: of efficiency and reducing waste when we have a much
[7:35] Speaker 1: more connected grid. And we're all familiar with these terms
[7:38] Speaker 1: connected grids, smart grid, and actually even the rise of
[7:40] Speaker 1: new business models like virtual power plants. But is there
[7:44] Speaker 1: a space for grids to not be connected with one
[7:47] Speaker 1: another and to have a series of non connected units
[7:50] Speaker 1: that you know, the connectivity essentially ends somewhere, And is
[7:53] Speaker 1: there thought being given to how connected is to connected?
[7:58] Speaker 2: That's a good question. I think that it would be
[8:02] Speaker 2: very difficult not to have connected grids because we need
[8:06] Speaker 2: both ram above and distribution grids and transmission grids and
[8:10] Speaker 2: interconnection among these grids to support a broader sustainable energy transition.
[8:16] Speaker 2: So I think what we need to do is understand
[8:19] Speaker 2: that the power grid is getting more and more access
[8:22] Speaker 2: to distributed energy resources such as evs such as roofs
[8:26] Speaker 2: of solar and batteries that are connected to the distribution grid,
[8:29] Speaker 2: which are connected to the transmission grid, which are communicating
[8:33] Speaker 2: more and more with one another to help balance the
[8:35] Speaker 2: overall power system. And as more of these decentralized energy
[8:40] Speaker 2: resources come online, the cybersecurity of power systems also needs
[8:44] Speaker 2: to reflect or mirror increasingly decentralized nature of the power
[8:48] Speaker 2: system as well. Because it's happening, We're seeing a lot
[8:51] Speaker 2: more virtual power plan projects. We're seeing a lot of
[8:54] Speaker 2: more distribe engry resources come online. So of course some
[8:58] Speaker 2: grids might like for example, microgrids, they can be islanded
[9:01] Speaker 2: when need be. But what we're seeing is that a
[9:04] Speaker 2: broader focus on coordinating the broader power system.
[9:08] Speaker 1: Now, cyber attacks are something that are probably not new
[9:11] Speaker 1: to any of us. We all think about phishing emails
[9:13] Speaker 1: when we think about our own inbox. And what I
[9:15] Speaker 1: want to know is how much of the focus I
[9:19] Speaker 1: guess on these cyber criminals is on the energy system.
[9:22] Speaker 1: And is this a big thing for us to be
[9:24] Speaker 1: worried about.
[9:24] Speaker 2: I mean, short answer, yes, Unfortunately, that's exactly what we're
[9:29] Speaker 2: seeing is that cyber attacks on utilities are on the rise,
[9:33] Speaker 2: and the frequency of cyber attacks on utilities are reaching
[9:38] Speaker 2: even new very high levels. And this is because as
[9:42] Speaker 2: we digitalize the power system and connecting more and more
[9:45] Speaker 2: connected resources. Connecting mean that they're connected to the internet,
[9:49] Speaker 2: it means that the cyber attacks surface of the power
[9:51] Speaker 2: system is growing and because of that, we're seeing more
[9:54] Speaker 2: cyber attacks. So the frequency of cyber attacks on utilities
[9:59] Speaker 2: we saw reach very high levels during the pandemic and
[10:02] Speaker 2: part driven by more remote work and cyber attacks have
[10:05] Speaker 2: also been increasing since the war in Ukraine, potentially because
[10:09] Speaker 2: this is allowing threat actors to showcase their cyber war
[10:12] Speaker 2: for techniques. So it's clear that this geopolitical and social
[10:16] Speaker 2: issues and upheaval usually leads to an increase in cyber attacks,
[10:20] Speaker 2: and this seems to indicate that the energy sector really
[10:24] Speaker 2: is becoming more and more of a target. For example,
[10:26] Speaker 2: according to the data from IBM, the energy sector for
[10:29] Speaker 2: about eleven percent of the total global number of cyber
[10:32] Speaker 2: attacks IBM tracked in twenty twenty two, which is higher
[10:36] Speaker 2: than the sector's pre pandemic levels of about six percent,
[10:39] Speaker 2: and North America in particular has been the most targeted
[10:43] Speaker 2: region for attacks, according to this data on energy firms
[10:46] Speaker 2: over the past two years.
[10:48] Speaker 1: What happens after a cyber attack? Do the consequences include
[10:53] Speaker 1: needing to as you referenced, know if something gets broken,
[10:56] Speaker 1: repairing kit or is this a conversation around actually being
[10:59] Speaker 1: held round because that happens sometimes as well, where they
[11:02] Speaker 1: won't release your system until you've paid a certain amount
[11:05] Speaker 1: to the cyber criminal. What happens and how do these
[11:08] Speaker 1: companies respond to these attacks when something does go wrong?
[11:13] Speaker 2: Yeah, I mean a cyber attack can make many things
[11:16] Speaker 2: go wrong, from money being lost due to just downtime
[11:20] Speaker 2: of the power system, to having to pay off ransomware,
[11:23] Speaker 2: to potentially having to pay fines because the cyber attack
[11:26] Speaker 2: was caused by some kind of non compliance with regulation,
[11:30] Speaker 2: or you know, fixing or repairing damage equipment. We've seen
[11:33] Speaker 2: that Also, IBM estimates the global average cost of a
[11:36] Speaker 2: data breach, which means just accessing illegitimate access of confidential data.
[11:42] Speaker 2: They're saying the global average cost of a data reach,
[11:44] Speaker 2: specifically for the energy sector, has reached nearly five million dollars,
[11:48] Speaker 2: and this is because actually identifying and dealing with those
[11:52] Speaker 2: reaches is getting costlier and taking longer because honestly, these
[11:56] Speaker 2: cyber thread actors are getting more and more sophisticated in
[11:59] Speaker 2: their techniques. At the same time, there's more technologies and
[12:04] Speaker 2: services coming out specifically to respond to these attacks, so
[12:07] Speaker 2: incident response technologies that includes both services like some companies
[12:13] Speaker 2: like Drego's offer services like playbooks, which are basically lists
[12:17] Speaker 2: of action items for specific cyber attacks that a company
[12:22] Speaker 2: can do, and Dregos is specifically focused again on operational
[12:25] Speaker 2: technologies such as in the grid. So other than services,
[12:28] Speaker 2: there's also startups and companies coming out with new technology
[12:32] Speaker 2: to support and even automate incident response. So, for example,
[12:36] Speaker 2: there's a technology or group of technologies called SORE like
[12:40] Speaker 2: Fly in all caps, which means Security Orchestration, Automation and Response,
[12:47] Speaker 2: which uses basically AI algorithms to help both detect and
[12:51] Speaker 2: automate some of the response to actual cyber incidents.
[12:55] Speaker 1: So there are new companies that are seeing this vulnerability
[12:59] Speaker 1: and fire a way to really help utilities figure this out.
[13:03] Speaker 1: But surely it's not all coming from startups looking to
[13:06] Speaker 1: strategically fix these problems. I would assume that the utilities
[13:10] Speaker 1: themselves are invading in various ways to protect themselves. What
[13:14] Speaker 1: is happening with the utilities and what other I guess
[13:17] Speaker 1: domestically grown technologies or responses are they then turning to
[13:22] Speaker 1: in order to secure their grid.
[13:24] Speaker 2: What we've been seeing really is that utilities are spending
[13:28] Speaker 2: more on cybersecurity and developing their own cybersecurity strategies, especially
[13:33] Speaker 2: the larger utilities. So basically that involves one developing business practices.
[13:39] Speaker 2: So that's things like growing security teams, having cybersecurity expertise
[13:44] Speaker 2: on board levels, and also running annual incident response practices,
[13:50] Speaker 2: kind of running hypothetical cyber attacks that might happen on
[13:53] Speaker 2: the utility and have the security teams actually practice what
[13:57] Speaker 2: they would do in that situation. That's the business evolutions side.
[14:02] Speaker 2: There's also a lot of new investments coming out of
[14:04] Speaker 2: utilities on cybersecurity. You know, what we're seeing is that
[14:07] Speaker 2: spending is on the rise on cyber For example, in
[14:10] Speaker 2: the US, we've seen that utility is a spending more
[14:14] Speaker 2: in terms of capital expenditure on cybersecurity, specifically operational technology security.
[14:19] Speaker 2: So for example, Southern California Edison or see their capex
[14:23] Speaker 2: on cybersecurity, Rose about two thirds from sixty million USD
[14:27] Speaker 2: in twenty twenty to nearly one hundred and ten million
[14:30] Speaker 2: in twenty twenty one. And that was kind of driven
[14:33] Speaker 2: by their grid modernization program to make sure that their
[14:37] Speaker 2: grid technologies really are cybersecurity. And you know, we're BNS,
[14:41] Speaker 2: so we had to quench the numbers. And we found
[14:43] Speaker 2: that in the US, be calculated that the annual cybersecurity
[14:46] Speaker 2: capex for utilities is likely already one billion US dollars,
[14:51] Speaker 2: with the average share of capex allocation usually around one percent.
[14:56] Speaker 2: And I mean, of course this might be higher or
[14:58] Speaker 2: lower by utility, but this real isn't a small number,
[15:01] Speaker 2: and it is likely to grow, we think as well.
[15:04] Speaker 2: One regulations get more strict and two when, if, and
[15:07] Speaker 2: when cyber attacks grow so.
[15:09] Speaker 1: Much like you can't drive a car without insurance in
[15:12] Speaker 1: many parts of the world, is there an obligation illegal
[15:15] Speaker 1: obligation in some countries for cybersecurity to be in place
[15:21] Speaker 1: because nobody wants blackouts, least of which the company is
[15:24] Speaker 1: operating the grid and also the power providers. But are
[15:28] Speaker 1: governments getting involved?
[15:30] Speaker 2: The US really is leading the way in terms of
[15:32] Speaker 2: regulation and standards for cybersecurity specifically in the power sector.
[15:36] Speaker 2: And I think that's potentially because cybersecurity has been seen
[15:39] Speaker 2: as a matter of national security for a while now.
[15:42] Speaker 2: And for example, in two thousand and eight, the North
[15:45] Speaker 2: American Electric Reliability Corporation NERK came out with mandatory standards
[15:51] Speaker 2: for critical infrastructure protection called NIRKSIP. Sorry a lot of
[15:55] Speaker 2: acronyms there, for both physical security and cybersecurity of the
[15:59] Speaker 2: bulk electric system. And bulk electric system here refers basically
[16:02] Speaker 2: to the transmission grid, so violations of these standards can
[16:06] Speaker 2: result in fines of up to one million dollars per
[16:09] Speaker 2: day per violation. But while the US has been kind
[16:12] Speaker 2: of leading the charge in cybersecurity regulation and policy, I
[16:16] Speaker 2: think also Europe is catching up. Originally, the European Union
[16:20] Speaker 2: couldn't really impose strong regulations for power system cybersecurity because
[16:24] Speaker 2: issues like cybersecurity are really related to national security, and
[16:28] Speaker 2: I think countries don't really appreciate when you meddle into
[16:31] Speaker 2: matters of national security, so it was difficult to do that. However,
[16:35] Speaker 2: as cybersecurity is becoming more of an issue, and also
[16:39] Speaker 2: I mean, we have a bunch of grid interconnections among
[16:41] Speaker 2: European countries, which means a cyber attack in one country
[16:45] Speaker 2: might affect another country. The EU is stepping up their
[16:48] Speaker 2: cybersecurity directives as well, and the biggest thing there right
[16:51] Speaker 2: now we're seeing is the Network and Information Security Directive
[16:55] Speaker 2: or NIS number two, which is an update of that directive,
[16:59] Speaker 2: which basically calls for essential entities which includes grids, to
[17:04] Speaker 2: ramp up their cybersecurity measures. And there's a lot of
[17:07] Speaker 2: fines there too, and it has to requires member states
[17:10] Speaker 2: to basically set a maximum fine of at least ten
[17:12] Speaker 2: million euros, which is about ten point six million dollars
[17:16] Speaker 2: or two percent of their global annual revenue, whichever is
[17:19] Speaker 2: higher if they fail to comply. So I think the
[17:22] Speaker 2: European Union is also ramping up regulation here.
[17:25] Speaker 1: Now you're only as strong as your weakest link. Is
[17:28] Speaker 1: there a specific part of the network that is most vulnerable?
[17:32] Speaker 1: And how do most of these problems actually get in?
[17:37] Speaker 1: Is it malware connected to an email or is it
[17:40] Speaker 1: something else? Is it our smart refrigerators or the electric
[17:43] Speaker 1: vehicles connected to the grid directly, where are the biggest vulnerabilities?
[17:47] Speaker 2: I mean, based on what I've seen, most cyber attacks
[17:51] Speaker 2: on utilities are still the regular ones, So phishing or
[17:55] Speaker 2: through public facing applications or through websites and stuff like that.
[18:00] Speaker 2: But as we get more and more distributed enjury resources
[18:03] Speaker 2: connect to the grid, like electric vehicles, smart meters, even
[18:08] Speaker 2: air conditioning units are becoming smart nowadays and can give
[18:11] Speaker 2: and take electricity from the paragrid, it means that we're
[18:14] Speaker 2: getting more and more end points connecting to the paragrid
[18:18] Speaker 2: which are also connected to the Internet. And this means
[18:20] Speaker 2: that honestly, utilities networks are becoming far more complex than
[18:25] Speaker 2: they used to be and have far more endpoints than
[18:27] Speaker 2: they used to be, which means that having regular firewalls.
[18:32] Speaker 2: I think when we think about cybersecurity, right we think
[18:34] Speaker 2: about traditional firewalls, which are basically like putting a giant
[18:37] Speaker 2: fence around your corporate network. That's really not enough anymore
[18:41] Speaker 2: as we have more and more of these endpoints flooding
[18:43] Speaker 2: utilities network, So that's really calling for new sets of
[18:47] Speaker 2: cybersecurity technologies down to the actual endpoints, specific security measures
[18:53] Speaker 2: for these distributed energy resources and within the network.
[18:57] Speaker 1: So if I had to break this down in its
[18:58] Speaker 1: simplest sense, it is a system that is connected to
[19:03] Speaker 1: the electrical grid and in some way is trying to
[19:06] Speaker 1: decide whether or not it pulls electricity or it stops
[19:09] Speaker 1: pulling electricity based on what it's getting in terms of
[19:13] Speaker 1: data from that grid, regarding perhaps peak demand at that time,
[19:17] Speaker 1: in power prices or whatever that input is. What I'm
[19:20] Speaker 1: wondering is with these firewalls that exist, those that are
[19:23] Speaker 1: trying to break into the network, is it that the
[19:26] Speaker 1: network inherently has vulnerabilities and they find those? And this
[19:31] Speaker 1: raises the question of AI and an increasingly smart computer
[19:35] Speaker 1: system that can go through a number of permutations very
[19:38] Speaker 1: quickly and find those vulnerabilities versus when human being and
[19:42] Speaker 1: mistakes do happen, responds to as you mentioned, phishing and
[19:46] Speaker 1: essentially allows that vulnerability to happen because they made a mistake.
[19:50] Speaker 1: I would expect that both of these exist, and you
[19:52] Speaker 1: said the vast majority are coming from fishing right now.
[19:55] Speaker 1: My question there lies, do we think that first scenario
[19:59] Speaker 1: that I went through the w and where AI and
[20:01] Speaker 1: locating those vulnerabilities without being aided by someone like myself
[20:05] Speaker 1: clicking on the wrong thing, is that something that we
[20:08] Speaker 1: additionally need to think about in the future.
[20:10] Speaker 2: Phishing is one that we know of for now, but
[20:14] Speaker 2: I think as we have more resources connecting to the grid,
[20:18] Speaker 2: we have more entry points for cyber attackers. So, for example,
[20:21] Speaker 2: if we think about electric vehicles, even though a utility
[20:25] Speaker 2: has its own set of cybersecurity measures, it needs to
[20:28] Speaker 2: interface with an increasing amount of additional second and third
[20:32] Speaker 2: party players. Right, so, every think about EV's they connect
[20:35] Speaker 2: to the grid, and for example, a startup called si
[20:38] Speaker 2: Flow is focused specifically on EV cybersecurity, and based on
[20:42] Speaker 2: data that they're sharing, they show that the communications protocol
[20:47] Speaker 2: used for EV charging management systems can be compromised by
[20:52] Speaker 2: cyber thread actors, and by doing that, the thread actor
[20:55] Speaker 2: could for example, turn EV chargers on and off, or
[20:58] Speaker 2: even steal and as more evs come online as v
[21:02] Speaker 2: an EFC's will happen in our new energy outlook and
[21:06] Speaker 2: electric vehicle outlooks, if we do depend more and more
[21:10] Speaker 2: on electric vehicles and systems like vehicle to grid where
[21:13] Speaker 2: the power system calls on EV's to help support the grid,
[21:17] Speaker 2: this could really cause damage as well. So basically what
[21:20] Speaker 2: I'm trying to say is as more endpoints come online
[21:23] Speaker 2: and the grid depends more and more on distribute energy
[21:25] Speaker 2: resources which are also connected, that's a huge issue on
[21:29] Speaker 2: the endpoint security level, which is kind of lacking right now.
[21:33] Speaker 1: So when I think about hacking, I think about non
[21:36] Speaker 1: state actors, but we also know that some of these
[21:38] Speaker 1: are either first of all state sponsored or secondly, is
[21:41] Speaker 1: there a fear that essentially this could be weaponized.
[21:45] Speaker 2: Yeah, I mean what's a bit scary is that cyber
[21:48] Speaker 2: thread actors are getting better and better at specifically developing
[21:53] Speaker 2: malware and attack techniques targeting operational technologies like substations on
[21:58] Speaker 2: the power grid, Meaning they're figuring out how to launch
[22:02] Speaker 2: cyber attacks that are tailor made for the power grid,
[22:05] Speaker 2: and this can definitely be used in cyberwarfare. So a
[22:10] Speaker 2: very famous example of an attack on an industrial control
[22:14] Speaker 2: system was stucksnet, which basically targeted a nuclear power plant
[22:19] Speaker 2: in Iran by taking advantage of a software vulnerability to
[22:23] Speaker 2: access controllers in that plant, and basically the attackers use
[22:29] Speaker 2: this vulnerability to compromise the control system and make the
[22:33] Speaker 2: centrifuges spin too fast, causing damage to the plant. So
[22:38] Speaker 2: this and some other examples we've seen around the world
[22:40] Speaker 2: are kind of showing us that cyber warfare is an
[22:43] Speaker 2: increasingly normal thing, specifically targeting the power system.
[22:47] Speaker 1: Another data point that came up also from IBM is
[22:50] Speaker 1: that the cost per data breach is averaging around four
[22:54] Speaker 1: point seven eight million US dollars each time. So this
[22:58] Speaker 1: is expensive. It's expensive for the breech and invariably now
[23:01] Speaker 1: it's costing more money to try and prevent them and
[23:04] Speaker 1: cut it off at the past. So this is a
[23:05] Speaker 1: burgeoning industry of companies that are looking to service this.
[23:09] Speaker 1: But what is the next thing for you now that
[23:11] Speaker 1: you've spent time researching this, What is the next thing
[23:15] Speaker 1: that you're going to look at and look into that
[23:18] Speaker 1: hasn't been covered in this research note in the vein
[23:20] Speaker 1: of trying to better understand cybersecurity.
[23:23] Speaker 2: That's a good question. I think what I've been seeing
[23:26] Speaker 2: in general in cybersecurity tech innovation is that the security
[23:30] Speaker 2: focus is coming closer and closer to the end resource
[23:33] Speaker 2: or the endpoint. So it's going from being this massive
[23:36] Speaker 2: firewall around the network to end point security, which basically
[23:40] Speaker 2: gives endpoints like ev smart meter substations their own set
[23:44] Speaker 2: of security measures. And this endpoint or resource focused security
[23:48] Speaker 2: also brings us the access control, So we've been seeing
[23:51] Speaker 2: a lot of innovation and access control, which traditionally is
[23:55] Speaker 2: things like encryption or firewalls or multi factor authentication. And
[24:00] Speaker 2: what interesting innovations here are zero trust models and quantum
[24:05] Speaker 2: resistant encryption. So in a zero trust model, access is
[24:08] Speaker 2: basically provided to resources like a substation, for example, or
[24:13] Speaker 2: a smart meter on a per asset and per request basis,
[24:17] Speaker 2: as opposed to kind of you know, allowing access to
[24:19] Speaker 2: all assets in a network once an actor is within
[24:23] Speaker 2: a firewall. So for example, ge and other tech vendors
[24:26] Speaker 2: are beginning to integrate zero trust architecture as a layer
[24:31] Speaker 2: in their grid software portfolios. And then on top of that,
[24:34] Speaker 2: another interesting innovation is think about a future when quantum
[24:38] Speaker 2: computing becomes a reality. Encryption like today's encryption can be
[24:42] Speaker 2: easily decrypted with an actual functioning quantum computer. So encryption
[24:47] Speaker 2: today needs to get up to speed, so new kinds
[24:50] Speaker 2: of cryptography or post quantum cryptography can help. For example, IBM,
[24:55] Speaker 2: Google and university partners co developed a kind of lattice
[24:59] Speaker 2: day digital signature in which encryption security relies on the
[25:04] Speaker 2: difficulty of finding short vectors and lattices. So basically what
[25:08] Speaker 2: that means is it's a very very difficult mathematical problem
[25:12] Speaker 2: about finding specific vectors in a three dimensional space. So
[25:17] Speaker 2: definitely we've been seeing some cool innovations in access control
[25:20] Speaker 2: and any kind of tech that's bringing the security closerts.
[25:23] Speaker 1: At the end, resource, I love that the form of
[25:27] Speaker 1: protection you brought up is called zero trust architecture.
[25:30] Speaker 2: It makes exactly it really, don't trust anyone.
[25:34] Speaker 1: Don't trust anyone I might click on that phishing email. Amanda.
[25:40] Speaker 1: Thank you so much for walking us through not only
[25:42] Speaker 1: what's happening with cybersecurity, but also this different set of vocabulary,
[25:47] Speaker 1: so these different systems that are being used in different acronyms,
[25:50] Speaker 1: and also my personal favorite from the show, zero trust architecture.
[25:54] Speaker 2: Thanks for having me.
[26:04] Speaker 1: Bloomberg NEF is a service provided by Bloomberg Finance LP
[26:07] Speaker 1: in its affiliates. This recording does not constitute, nor should
[26:11] Speaker 1: it be construed as investment advice, investment recommendations, or a
[26:15] Speaker 1: recommendation as to an investment or other strategy. Bloomberg NEF
[26:19] Speaker 1: should not be considered as information sufficient upon which to
[26:22] Speaker 1: base an investment decision. Neither Bloomberg Finance LP nor any
[26:26] Speaker 1: of its affiliates makes any representation or warranty as to
[26:29] Speaker 1: the accuracy or completeness of the information contained in this recording,
[26:33] Speaker 1: and any liability as a result of this recording is
[26:36] Speaker 1: expressly disclaimed.

Shows are listed from Apple Podcasts' charts and directory, and Podcast Index where it is used. Every show and episode belongs to its publisher and plays from the publisher's own feed; this site hosts none of them.