Cyber security |


Under attack


Rapidly modernising hydropower fleets are an attractive target for adversaries and such threats need to be taken seriously. In an effort to examine the vulnerabilities of its hydropower projects, a subcommittee hearing was recently held in the US. Report by Suzanne Pritchard


Above: The seriousness of cyber threats to critical US infrastructure has been clear for years


“AS THE GRID CONTINUES to evolve, so, too, do the threat actors who seek to undermine US critical infrastructure,” said Scott Aaronson, Senior Vice President for Security and Preparedness at the Edison Electric Institute (EEI). “With the increasingly complex geopolitical threat landscape and the sophistication of ransomware operations by transnational organised criminals, we have seen an uptick in threats to critical infrastructure organisations across all sectors,” he warned.


Cyber-attacks within the waterpower and dam industry have become more commonplace in recent years. In 2013 the controls at Bowman Dam in Rye New York were infiltrated and this, along with exploitation of programmable logic controllers in Pennsylvania and across the water and wastewater systems sector in late 2023, were attributed to Iranian government-affiliated cyber actors. In April 2023, Hydro Quebec’s website and customer app were made temporarily unavailable in an attack attributed to a Russian actor group unhappy with Canadian policies supporting Ukraine.


62 | May 2024 | www.waterpowermagazine.com


There have also been numerous other incidents worldwide such as in Norway where Norsk Hydro was forced to shut down facilities in 2019, leading to more than US$71 million in financial losses. Then, in Australia, water supplier Sunwater was targeted by a nine-month long security breach in 2021-2, and in May 2022 the Ethiopian Information Network Security Agency reported a cyber attack at the Grand Renaissance Ethiopian Dam had been thwarted before any data could be accessed. With the above examples in mind, it’s hardly surprising that global estimates suggest that the cost of cybercrime will be in the region of US$8 trillion, with energy and utility companies continuing to be prime targets. Virginia Wright from the Idaho National Laboratory in the US explains why. “According to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, cybersecurity threats to critical infrastructure are one of the most significant strategic risks for the US,” she said, adding that nation states are targeting critical infrastructure to gain access to control systems


Page 1  |  Page 2  |  Page 3  |  Page 4  |  Page 5  |  Page 6  |  Page 7  |  Page 8  |  Page 9  |  Page 10  |  Page 11  |  Page 12  |  Page 13  |  Page 14  |  Page 15  |  Page 16  |  Page 17  |  Page 18  |  Page 19  |  Page 20  |  Page 21  |  Page 22  |  Page 23  |  Page 24  |  Page 25  |  Page 26  |  Page 27  |  Page 28  |  Page 29  |  Page 30  |  Page 31  |  Page 32  |  Page 33  |  Page 34  |  Page 35  |  Page 36  |  Page 37  |  Page 38  |  Page 39  |  Page 40  |  Page 41  |  Page 42  |  Page 43  |  Page 44  |  Page 45  |  Page 46  |  Page 47  |  Page 48  |  Page 49  |  Page 50  |  Page 51  |  Page 52  |  Page 53  |  Page 54  |  Page 55  |  Page 56  |  Page 57  |  Page 58  |  Page 59  |  Page 60  |  Page 61  |  Page 62  |  Page 63  |  Page 64  |  Page 65  |  Page 66  |  Page 67  |  Page 68  |  Page 69  |  Page 70  |  Page 71  |  Page 72  |  Page 73  |  Page 74  |  Page 75  |  Page 76  |  Page 77