Cybersecurity in the Electric Sector: Update on Threats and Defenses Presented to: Oregon Public Utilities Commission June 28, 2018

Presenter Background 17 years in cybersecurity related roles in the sector PacifiCorp | Senior Cybersecurity Consultant | 2001-2009 WECC | Senior CIP Compliance Auditor | 2009-2010 EnergySec | Vice-President | 2010-2013 EnergySec | President | 2013 – Present Industry Consulting | 2012 – Present CISSP, CISA

Overview Source of threats has not changed significantly in recent years Nation States Terrorists Financially motivated attackers Capabilities of attackers continues to increase Industry defenses continue to mature Likelihood of attack remains an unknown

NERC State of Reliability Report Released June 21, 2018. Reviewed previous year No Reportable Cybersecurity Incidents in 2015-17 Phishing is largest attack vector (June 2017) Advisory on APT targeting sector (Sep 2017) Dragonfly APT - report from Dragos (Nov 2017) Safety Systems attacked in Middle East 2018 Outlook: More phishing. Targeting of Trusted Business Partners. Crypto Mining.

Recent News Dragos Blog: XENOTIME https://dragos.com/blog/20180524Xenotime.html Described as most dangerous group currently known. No attribution of group affiliation Responsible for TRISYS attack against safety system Active since 2014 and involved globally Believed to be seeking to do harm

Recent News Electrum – Group responsible for Ukraine attacks may be expanding to other regions VPNFilter – Broad attack against consumer-class network routers. Malware had Modbus related capabilities Hidden Cobra – Threat group believed to be associated with North Korea. New malware families associated with this group

What is Industry Doing? ESCC E-ISAC CRISP Cyber Mutual Aid GridEX NRECA/APPA capacity building for small utilities Supply Chain security whitepapers

What is Government Doing? DOE CESER – New centralized office for cybersecurity efforts CEDS – Government funded security research ESCC – CEO level industry/government collaboration DOE Security Strategy NERC CIP Core standards stabilizing New Supply Chain standards expected soon Possible new standards on incident reporting

Trends Increasing focus on control system security Many new vendors in the marketplace Early stage adoption in industry Security staff sizes are increasing 24x7 operations more common for large utilities Shortage of skilled workers is a challenge Moving beyond compliance… CIP standards still a driver, but security is greater focus

Trends Information Sharing Improving, but still lacking E-ISAC growing. 2019 budget request $27.3 million Zero Reportable Cybersecurity Incidents Increasing reporting of below-threshold events FERC may order stronger reporting requirements Increasing focus on small utilities/distribution DOE grants to APPA and NRECA ($2.5MM/year) Possible collaboration with National Guard

Summary There are still many unknowns regarding grid security Motivations and likelihood of attack Overall state of security across thousands of organizations is impossible to measure Industry readiness is difficult to assess in the absence of experienced attacks There are ALWAYS unknown vulnerabilities Industry continues to mature and is putting significant effort into improving security posture

Questions

Thank You Steven H Parker President, EnergySec steve@energysec.org 503.905.2923 (desk) @es_shp (twitter) www.energysec.org