According to a new World Energy Council report, keeping the lights on is becoming an increasingly difficult task nowadays. It warned of a “massive increase” in the number of successful cyber attacks in the past year against energy firms.
Following the trends, India is set to see a countrywide cyber security audit of its power distribution and generation system to prevent hacking as state grids and plants which increasingly became smarter with large-scale deployment of digital technology.
Indian power equipment manufacturers have repeatedly been raising alarm over the issue as city grids are being smartened up with SCADA (supervisory control and data acquisition) systems.
SCADA is a computer based industrial automation control system that practically makes factories and utilities run on their own. In an electrical system, SCADA maintains balance between demand and supply in the grid.
Chinese firms have bagged SCADA contracts for more than 18 cities. More such contracts are on the anvil. Besides, they have also qualified to bid for three transmission links being laid by the Centre to strengthen the national grid.
SCADA contracts have long tenures and include maintenance of equipment. Transmission lines are given on build, own, operate, and transfer basis spanning up to 35 years. This allows contractors to place their personnel on site in case of SCADA projects and control operations
in transmission lines, allowing ample scope for planting of bugs at a later stage.
The states also agreed to conduct mock drills simulating disasters and hackings to test preparedness for reviving downed systems. Government sources said they also agreed to nominate a chief information security officer, an acknowledgement of cyber threats and the need to take them seriously.
Potential Risk in the event of cyber attack on Power Grid
• Physical damage to electric system
The possibility of a cyber-attack causing physical damage to electric system equipment is very high. Attacker can cause huge amount of destruction through cyber attack on power distribution system. An attack was performed by researcher of National laboratory in which a diesel generator was destroyed by a simulated cyber attack; attacker can use same method to destroy the powergrid.
• Denial of service Claims-A cyber attack on phone systems, possibly a Denial of Service (DoS) attack, can prevent the utilities from receiving calls from customers reporting outages.
• Power Service Disruption (Business Interruption) – The Cyber attack on Power Grid can result in disruption of power supply and cause huge amount of restoration cost and loss of revenue. The attacker can employ a variety of techniques to delay the utilities’ recovery efforts, including disabling control centre battery backup power, preventing grid operators from sending remote commands to re-close the circuit breakers and restore power, erasing and corrupting various systems at the utilities using cyber attack.
• Third Party legal liability- If customer’s personal data are compromised during cyber attack on Power Grid, they can sue Power Grid Company and may ask for compensation.
• Cyber Extortion- Once malware infects power grid’s system, it either encrypts critical files or locks a user out of their computer. It will prevent the Power grid company to restore the electricity supply to its normal stage. It then displays a ransom message that usually demands virtual currency payment in exchange for a cryptographic key to decrypt or unlock those resources. The message may also threaten to publicly release compromised data if the payment demand is notmet.
• Regulatory Responses Cost, Civil fines and Penalty
• Crises Management Expenses, Response costs, Forensic Investigations Cost.
Insurance Solution
Cyber Liability Insurance
Cyber Insurance covers losses arising from cyber attacks tend to fall into one of two categories – “first-party” losses (the Power Grid’s direct costs/loss) and “third-party” losses (liability losses).
First-party losses consist of costs directly incurred by the Power Grid as a result of the cyber attack, such as costs incurred in connection with business interruption, privacy notifications, public relations efforts, forensic investigations, restoration of data, and, ransom/extortion payments.
Third-party losses are liability losses, and include defense costs and indemnity payments in connection with customers’ claims for damages including defense cost and regulatory investigations.
Cyber insurance typically covers expenses related to first parties as well as claims by third parties.
(Disclaimer- Above mentioned report was prepared on the basis of information available in the public domain.)