DHS Publishes Report Saying Low but Persistent Risk of Cyber Attack on Energy Sector DHS REPORT ON ENERGY CYBERSECURITY April 6, 2016 | Ben Booker Source: Office of Intelligence and Analysis, “Intelligence Assessment: Damaging Cyber Attacks Possible, but Not Likely Against the U.S. Energy Sector,” Department of Homeland Security, January 27, 2016; Parkjisun, “Anonymous,” Noun Project, April 5, 2016; Creative Stall, “Eye,” Noun Project, April 5, FindingImplication Persistent, but low level threat from nation-state cyber actors Nation-state actors are constantly engaging in cyber activities against U.S. energy sector Most of the activities are cyber- espionage or maintaining access in order to introduce malware Major cyber attack would most likely only occur if nation-states engaged in open hostilities with U.S. Majority of cyber activities against energy sector are low-level cybercrime Most actors are seeking financial gain when targeting energy sector Seek intellectual property or hold data ransom Public misperception of cyber activity in energy sector DHS noted media’s inability to distinguish between cybercrime and cyber attacks Danger of public developing “risk fatigue” and unwillingness to act Major Findings of Department of Homeland Security’s Report DHS Recommendations for Bolstering Cybersecurity 1.) Implement current filters 2.) Keep anti-virus definitions up-to-date 3.) Maintain current software patches (software that updates computer program) for security 4.) Train employees in latest cybersecurity measures

Cybercrime Cost Energy Sector Companies Over $21 Million on Average Over the Past Six Years April 6, 2016 | Ben Booker Source: Ponemon Institute, “2015 Cost of Cyber Crime Study: United States,” October 2015; Office of Intelligence and Analysis, “Intelligence Assessment: Damaging Cyber Attacks Possible, but Not Likely Against the U.S. Energy Sector,” Department of Homeland Security, January 27, DHS REPORT ON ENERGY CYBERSECURITY ■ FY 2015 Costs ■ Six Year Average Average Annualized Cost of Cybercrime in Energy Sector, Millions of Dollars Costs Indicate Average Cost per Company Surveyed Energy Sector Big Target for Cyber Crime In 2015, energy sector was the second-most affected industry (behind finance) by cyber crime However, energy sector had the highest six year average DHS acknowledged in their report that energy sector potentially loses billions in cyber crime related activities annually

Financial, Energy, and Defense/Aerospace Sectors are the Most Affected by Cybercrime April 6, 2016 | Ben Booker Source: Ponemon Institute, “2015 Cost of Cyber Crime Study: United States,” October 2015; Office of Intelligence and Analysis, “Intelligence Assessment: Damaging Cyber Attacks Possible, but Not Likely Against the U.S. Energy Sector,” Department of Homeland Security, January 27, DHS REPORT ON ENERGY CYBERSECURITY ■ FY 2015 Costs ■ Six Year Average Average Annualized Cost of Cybercrime in Millions of Dollars by Sector Costs Indicate Average Cost per Company Surveyed