DOE Looks to Universities to Fix Energy Sector Cybersecurity

Nation-state attackers are actively targeting U.S. energy companies, power generation and distribution systems, but most of these utilities face challenges in the rush to adopt the latest digital technologies. They’re dealing with outdated infrastructure and a shortage of workers skilled in securing operational technology. To protect the energy sector, the federal government is banking on the next generation of engineers, cybersecurity experts and policymakers to spearhead transformative solutions.

See Also: OnDemand I Protecting your ICS Environment From Ransomware

The Department of Energy has announced a series of recent investments in research, development and demonstration projects at academic institutions across the country to better protect the sector against cyberthreats. It also issued $15 million in grants in March to establish six university-based electric power cybersecurity centers to promote collaborations across the energy sector and address gaps in energy security research, according to an announcement.

The University of Pittsburgh is among the schools selected by DOE’s Office of Cybersecurity, Energy Security, and Emergency Response to receive a $2.2 million grant for energy security research. Based in the second-largest natural gas-producing and nuclear power-generating state in the country, the university used the funds to launch the Cyber Energy Center to serve as a collaborative academic-industrial ecosystem.

The center and its research will in part have a unique focus on operational technology security across the energy sector and in critical infrastructure environments, according to Daniel Cole, an associate professor at the University of Pittsburgh’s Swanson School of Engineering and the director of the Cyber Energy Center.

“The two challenges that we have in the OT space are aging infrastructure … and the fact that industry can’t afford to have downtime,” Cole said. He added that updating and maintaining systems can be difficult in the energy sector because most facilities are in continuous operation.

Experts say the energy sector currently lacks the tools and resources to properly scan OT networks for cyber intrusions and malicious activity. The sector has become a growing target for hackers amid rapid modernization and increasing interconnectivity of IT networks that lack adequate security measures to defend against attacks.

DOE’s Office of Cybersecurity, Energy Security, and Emergency Response, or CESER, said the investments in university-based cyber centers will fund research “to find solutions that will reduce the risk of power disruption resulting from a cyber-incident in an energy system,” among other initiatives aimed at enhancing critical infrastructure cyber resilience. The centers also will be tasked with hosting cybersecurity education programs for the next generation of cyber professionals.

CESER Director Puesh Kumar said in a statement the investments in the university-based cyber centers will enable DOE “to simultaneously grow the U.S. cyber workforce and build the expertise we need to take on the evolving cyberthreats to our nation’s energy systems.”

“The U.S. competitive advantage has always depended on cutting-edge research and a high-skilled workforce,” the statement says, adding that the research projects will advance “economic and national security.”

The NCC Group’s 2024 Cyber Threat Intelligence Report focuses on threats to operational technology in the energy sector, and finds significant challenges around increased digitalization, supply chain risks and state-sponsored threat actors.

The report says Russian hackers and other cybercriminals are “developing their OT capabilities to target critical infrastructure,” including the energy sector. “Such developments appear to manifest in response to major geopolitical conflicts,” the report says.

One of the University of Pittsburgh’s Cyber Energy Center’s first studies will involve using digital models to assess the effectiveness of certain cybersecurity measures against attacks in the energy sector, as well as evaluating the impact of various cyber incidents that may occur in real-life scenarios. According to DOE, the center also has been tasked with forming a diverse set of project partners to help focus the study “on existing gaps in cybersecurity research.”

In many ways, the University of Pittsburgh was an appropriate place for DOE to potentially invest in the next generation of energy sector cybersecurity solutions. The school boasts on its website of having a “portfolio of expertise in information and operational technology” across its various programs, including the Energy GRID Institute, the Institute for Law Policy and Security, the School of Computing and Information – and now, the Cyber Energy Center.

The new cyber centers across the country will conduct a wide range of energy sector-related security research, according to DOE. Texas Tech University’s Cyber-Physical Security Center will focus on developing a framework for addressing the step-by-step stages of a cyberattack, from detection to recovery. The Illinois Institute of Technology’s Midwest Center for Microgrid Cybersecurity will address in part how system operators can contribute to efficient cyberattack detection and response. The Iowa State University Center for Cybersecurity and Resiliency will focus on improving distribution grid security and resiliency for microgrids and distributed energy resources.

The University of Pittsburgh’s cyber center brings together nearly 30 industry partners across operational technology, energy and security companies, and workforce development organizations – a critical component of its future research, Cole told Information Security Media Group.

“This is one of those problems that sits at an interesting interface of a lot of different disciplines,” Cole said. “We have lots of industry partners that fit into different parts of that puzzle.”