{"id":33388,"date":"2020-02-18T17:00:31","date_gmt":"2020-02-18T17:00:31","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=90627"},"modified":"2020-02-18T17:00:31","modified_gmt":"2020-02-18T17:00:31","slug":"defending-the-power-grid-against-supply-chain-attacks-part-1-the-risk-defined","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/defending-the-power-grid-against-supply-chain-attacks-part-1-the-risk-defined\/","title":{"rendered":"Defending the power grid against supply chain attacks\u2014Part 1: The risk defined"},"content":{"rendered":"
<\/div>\n

Most people don\u2019t think about electricity. If the internet works, their food is refrigerated, and their debit card is approved, why should they? Its ubiquity and reliability render it invisible\u2014a bit of magic that powers much of modern life. That is, until a large storm passes through. Localized outages can be quite disruptive to those impacted, and the utility industry has learned to respond rapidly and effectively to these events. But what happens if service interruptions become more unpredictable and affect large geographical regions with huge populations?<\/p>\n

This is a risk that utilities and their supply chain must continue to address. Nation state actors and other adversaries have demonstrated that they possess the ambition and the skills necessary to launch cyberattacks<\/a> that could cause widescale and continuous power outages. Whether your organization is a utility or a supplier of the industry, you may be vulnerable.<\/p>\n

This blog series, \u201cDefending the power grid against supply chain attacks,\u201d analyzes how these attacks are conducted and the steps utilities, device manufacturers, and software providers can take to better secure critical infrastructure.<\/p>\n

Why it matters<\/h3>\n

Modern warfare is no longer conducted exclusively on the battlefield. Nation-state actors also deploy sophisticated cybercampaigns to disrupt daily life or sow confusion. The power grid is one such target. The financial system, sewer and water lines, transportation networks, computers, cellphones, kitchen appliances, and more run on electricity. Several hours of disrupted power can grind economic activity to a halt in the affected areas. An outage of days or weeks could incite greater unrest.<\/p>\n

Accelerated adoption of the Internet of Things (IoT) compounds the risk. IoT innovations allow the utility industry to harness the power of the internet, data, and artificial intelligence to optimize its operations and deliver energy more efficiently and reliably to its customers. But these devices can introduce new vulnerabilities. Existing sensors often don\u2019t have security or centralized management built into them. Some devices are so small, it\u2019s difficult to place traditional protections on them. Manufacturers, who feel pressured to deliver solutions quickly, may fail to incorporate critical security controls and safeguards in their products. Bad actors are skilled at uncovering these weaknesses and exploiting them.<\/p>\n

How attacks are executed<\/h3>\n

A typical cyberattack includes lengthy reconnaissance to uncover all the vendors that serve a utility and their vulnerabilities. Bad actors even go after suppliers who exist outside the software and hardware space but have vital access. A few examples:<\/p>\n