Power, water and heat: What recent cyberattacks reveal about the resilience of critical infrastructure
Power, water and heat
What recent cyberattacks reveal about the resilience of critical infrastructure
A cyberattack on a Danish water utility caused pipes to burst and temporarily disrupted supplies to customers. Weeks later, operators of water and wastewater systems in 12 US states were forced to switch to manual operations after losing remote-control capabilities. Meanwhile, a small UK power generator was reportedly offline for four days following a cyberattack.
The circumstances varied, yet all the attacks were directed at the systems that support essential services such as power and water.
Recent attacks against critical infrastructure have attracted significant media attention, and rightly so. When essential services such as power, water, transport and healthcare are targeted, the consequences can extend beyond data loss or financial damage and affect the physical systems on which society depends.
Download DNV Cyber's Nordic Cyber Resilience research exploring the state of national cyber resilience in Norway and Sweden
Awareness of those risks appears to be growing. DNV's Cyber Resilience research among critical infrastructure operators in the Nordics found that 61% expect the failure of an essential public utility or service such as power, broadband, water or healthcare within the next 12 months1.
But do these incidents indicate a new cyber risk picture for national critical infrastructure operational technology (OT)?
Internet-exposed systems
Weak remote-access controls
Poor network segmentation
Inadequate visibility of connected assets
Trusted supplier relationships
Chris Robinson, Senior Principal Consultant, at DNV Cyber argues that these incidents do not represent a dramatic shift in the threat landscape. "On the OT side, attacks on critical infrastructure are not new," he says. "Smaller critical infrastructure operators are often attractive targets because they simply don't have the resources, expertise or personnel needed to manage cybersecurity effectively. It often becomes another responsibility placed on already busy engineers. As a result, these organizations can become targets of opportunity."
Smaller critical infrastructure operators are often attractive targets because they simply don't have the resources, expertise or personnel needed to manage cybersecurity effectively.
Chris Robinson
Senior Principal Consultant
DNV Cyber
Many incidents occur because systems are exposed to the internet and are relatively easy to find and access. A recent alert from US agencies highlighted active threats targeting internet-exposed devices such as programmable logic controllers (PLCs), the industrial computers that control physical processes in sectors including water, energy and manufacturing. PLCs manage activities such as opening valves, controlling pumps and regulating industrial equipment2.
"OT systems were designed to operate in isolated environments, not be connected to corporate IT networks or the internet," says Robinson. "Systems designed for reliability and operational performance are now exposed to cybersecurity risks they were never intended to face."
Over time, organizations have connected operational technology to gain access to data and operational insights. Vendors have also introduced remote access capabilities so they can support systems without travelling to site.
For Robinson, this growing exposure is often more important than questions of attribution. Discussions about geopolitics can distract from a more immediate concern: understanding how operational systems can be reached in the first place. Whether an attacker is linked to a nation state, criminal group or hacktivist movement, organizations still need to understand where their systems are exposed and how adversaries might gain access.
Artificial intelligence is adding a new dimension to OT risk, lowering the barrier for interacting with industrial systems by helping attackers understand technologies that previously required specialist knowledge.
"AI can help attackers understand OT systems and protocols that those outside the industry would not normally understand," explains Robinson. "This can help attackers interact more effectively with OT systems. AI can help the attacker get up to speed more quickly and suggest how a process might be operating which can increase the likelihood an attack will succeed."
The AI Threat
While AI does not replace operational expertise, it can accelerate how quickly attackers understand unfamiliar industrial environments.
Increase the speed and scale of attacks using existing techniques.
Interpret technical documentation and engineering drawings.
Understand industrial protocols.
Identify potential attack paths more quickly.
Develop phishing and social engineering campaigns targeted at operational staff.
That does not mean AI replaces operational knowledge. "If an attacker wants to control a process and achieve a specific outcome, they still need to understand what's happening in the OT environment" continues Robinson. "Whether that's chemical manufacturing, an oil refinery, electrical generation or water treatment, each environment operates differently. I don't think AI is going to replace that understanding, at least any time soon."
Why attacks that fail still matter
While not every attack results in a blackout, a loss of water supply or other visible disruption, attackers can still learn valuable information about how systems operate, where controls are weakest and how they might return in future. For this reason, Robinson argues that gaining access to an operational environment should be treated as a serious event in its own right.
One challenge in OT environments is that attackers can sometimes remain inside systems for extended periods before being detected.
"The concern isn't only about what an attacker does today," says Robinson. "The concern is what they may be capable of doing tomorrow. If they choose to act, they may be able to disrupt power, create societal disruption or affect critical services."
Cyber incidents also provide valuable lessons for operators. They reveal which defenses are working, where detection capabilities are weak and how attackers gained access in the first place.
Understanding the attack surface
For Robinson, the starting point for operators to evaluate the risk of an attack is to understand the attack surface.
"People often think attack surface means vulnerabilities. I don't think that's the right way to look at it," he says. "The attack surface is every way an attacker can interact with your environment."
That interaction is not always direct. In some industrial settings, information flows from IT systems into OT environments. If an attacker can manipulate that information before it reaches an operational process, that indirect path forms part of the attack surface too.
One practical step is regularly reviewing the attack surface, especially any external systems such as remote access. Tools are widely available that can help organizations identify assets visible from the internet and assess whether they should be accessible at all.
Building resilience through architecture
Network architecture is equally important. Many industrial systems cannot easily be patched or upgraded, so operators often have more influence over how systems are connected than over the systems themselves.
"Operators need to undertake proper segmentation of networks," says Robinson. "If an attacker gets into the environment, are they fairly limited, or can they move laterally through it?"
Effective segmentation can help contain an incident before it affects larger parts of an operation. In industrial environments, resilience often depends on whether critical systems can be isolated and protected from wider compromise.
Identify internet-facing OT assets and review whether they should be externally accessible.
Implement and validate network segmentation between IT and OT environments.
Review third-party and supply chain access.
Test incident response and crisis management plans.
Include OT systems in cybersecurity exercises, incident response and business continuity planning.
Balance cybersecurity investment across prevention, detection and response/recovery.
Investing in operational resilience
Robinson also recommends that operators examine how cybersecurity resources are allocated.
"The majority of most organizations’ cybersecurity budget sits in the IT environment," he says. "We need to make sure that OT cybersecurity is also sufficiently invested in with a good balance across prevention, detection and response/recovery, and that OT experts have a seat at the table."
Organizations should include operational technology considerations in penetration testing activities. Often the most revealing exercise is not targeting OT directly, but understanding what information about OT systems can be gathered from IT environments.
"Can attackers access engineering documents? Can they identify remote-access solutions? All of these things help attackers understand how an environment works."
Suppliers are another potential source of vulnerability. "Vendors may require remote access into OT environments as part of their maintenance contracts, which creates a new attack surface," says Robinson. "Even vendors on site can represent a risk. As soon as they connect to one of my systems, they could be introducing malware or some sort of backdoor."
The concern is reflected in DNV's Cyber Resilience research, where only 39% of critical infrastructure respondents expressed confidence in the cyber resilience of their immediate supply chain3.
Software suppliers can also introduce risk through components within products and services. Robinson points to the Log4J vulnerability, known as Log4Shell, which forced organizations worldwide to identify where a widely used open-source software component had been embedded in their systems4.
"We've seen multiple times where a significant vulnerability is discovered in an open-source software package that is used all over the place," he says. "If you ask a vendor across all their product lines whether they use a particular software package, they may or may not be able to tell you."
If you ask a vendor across all their product lines whether they use a particular software package, they may or may not be able to tell you.
Chris Robinson
Senior Principal Consultant
DNV Cyber
According to Robinson, engineering teams also have a critical role to play. "Engineers are used to designing out safety risk, but they need to factor in cyber safety too, so that systems can be disconnected and operate in isolation. They can design projects so that they can maintain operations even when parts of the system have to be shut down due to a cyberattack."
Business continuity planning should reflect that reality. The key question is “How do we continue operations while we're under attack?"
The issue has become increasingly important. DNV's Cyber Resilience research found that 42% of critical infrastructure operators believe organizations in their sector are inadequately prepared to restore core services following a serious cyber incident5.
Robinson believes operators may also underestimate how defendable operational environments can be. Unlike corporate IT networks, where users constantly install software, browse the internet and introduce new variables, industrial systems typically operate in a far more predictable manner.
"These are very static environments," he says. "We have a very predictable environment that we can learn and monitor, but we still need to do the basics. If we're not doing those, these attacks will continue to happen."
For Robinson, that is the key lesson from the attacks seen across Europe and North America. The challenge is not simply preventing cyber incidents. It is understanding where systems are exposed, detecting adversaries early and ensuring essential services can continue operating even when parts of the digital environment can no longer be trusted.
