Harnessing Water, Defending Data: Cybersecurity in Hydropower and Dam Facilities

Dams and hydropower facilities have long been attack targets, with a history that spans wartime conflicts. During World War II, the British Royal Air Force formed a group of pilots known as the Dambusters. Their mission: to destroy critical dams in Germany; considered ideal targets due to the significant disruption they could inflict on both water and power supplies.

In 2023 however, the landscape has somewhat shifted. The global cost of cybercrime is projected to soar to $8 trillion. Due to the immense value of data and the potential for widespread disruption, energy and utility companies continue to be prime targets.

Today, the hydropower and dam industries, like many others, stand at a crossroads where innovation and cybersecurity converge. Even a seemingly minor misstep, for instance, untimely dam operations, can unleash havoc upon nearby towns, significantly hampering supply chains and inflicting widespread destruction upon adjacent regions.

Types of cyber threats: State-sponsored and hobby

Cyber threats can be split into two main types. The first is state-sponsored cyber attacks. Those that are planned and funded by governments or nation-states. Kevin Curran, professor of cyber security at Ulster University, recently described cyberattacks by the UK’s enemies as becoming “relentless”. As an example, the Cozy Bear and LockBit hacker groups are believed to be associated with one or more intelligence agencies of Russia, the latter having known links to Russian nationals.

Secondly, hobby-hacker attacks. These hackers are usually motivated by either monetary gain or a wish to cause mischief. One of the most notorious examples is the Colonial Pipeline attack. The company paid the hacker group known as DarkSide 75 bitcoin ($4.4 million) to obtain a decryption key which enabled the company’s IT staff to regain control of its systems.

Growing intricacies of infrastructure create more vulnerabilities

The rising integration of Internet of Things (IoT) devices and sensors within the hydropower and dam sector has brought greater infrastructure complexity, creating more vulnerabilities for several reasons:

• Increasing number of attack surfaces: Every device connected to the network becomes a potential target for attackers. The more IoT devices, sensors and so on that are introduced, the further the range for potential attacks is increased.
• Device security: The substantial volume and often remote location of IoT devices increases the difficulty of keeping firmware and software up-to-date. Moreover, their physical dispersion can expose them to theft and tampering.
• Lack of standardisation: Different manufacturers exercise varying levels of security. The lack of standardisation can make it challenging to implement consistent security practices across all devices.
• Legacy systems: Many critical infrastructure systems still rely on older, legacy technology that may not have been designed with modern cybersecurity standards in mind. These systems are often more vulnerable to attacks.
• Interoperability challenges: Ensuring that different IoT devices and systems work together can be challenging. This can lead to security compromises to enable connectivity, potentially weakening overall security.
• Network visibility: Depending on the network’s connectivity and device location, a 360 view can be difficult to achieve and maintain, making it more difficult to detect and respond to cyber attacks.
• Data privacy: IoT devices often collect and transmit sensitive data. Inadequate data protection measures can lead to data breaches, compromising privacy and potentially providing valuable information to attackers.

The convergence of operation and information technology

Traditionally operational technology (OT) and information technology (IT) data streams remained distinct, which had the benefit of keeping OT systems ‘air gapped’ from the internet, and therefore at limited risk from hacking. As technology unifies OT and IT, it brings both efficiencies and risks. The efficiencies are numerous: by combining SCADA data with the systems that manage physical infrastructure, you can autonomously optimise performance.

But because OT systems haven’t been targets in the past, they’re not always built with security in mind. Passwords are often left at the default character string; remote monitoring for suspicious behaviour hasn’t been implemented; patches are not implemented as frequently as they should be.

In this evolving landscape, it’s critical that security teams are aware of these vulnerabilities and take steps to address them, safeguarding critical infrastructure in the hydropower and dam sector.

These cyber attacks underscore the importance of proactive measures and resilience in the face of evolving threats and crucially, they highlight the importance of engaging and sharing knowledge between peers. As Eric Doerr, General Manager of the Microsoft Security Response Center puts it – “When companies do this, it makes us all better and makes the attackers work harder.”
 

Ensuring the security of critical components in hydropower and dam facilities

Assess cyber risks

1. Identify critical assets: Which assets are most important within the facility/network?
2. Assess potential risks: What are the potential threats to the identified critical assets? Data breaches, malware attacks, etc.
3. Prioritise risks: Which potential risks are more likely to occur and which would have the most significant impact? By prioritising risks, companies can focus resources accordingly.

The above list is by no means exhaustive, but it does highlight a fundamental truth: In the constantly evolving landscape of cybersecurity, proactive measures are a necessity. Anticipating and addressing vulnerabilities before they become threats is pivotal to achieving and maintaining robust cybersecurity practices. If you would like to explore your connectivity and/or data security options with our experienced team, don’t hesitate to get in touch by emailing hello@groundcontrol.com.