Cybersecurity@ PGE Chris Nolke, Director of Cybersecurity Thursday, June 28, 2018

Our primary objective: protection We protect against Cybersecurity threats to ensure: the reliability of customer power customer, employee, and PGE data remains protected the safety of PGE employees and customers We do this efficiently and effectively by: studying the tools, techniques, and procedures of current adversaries efficiently applying controls to protect, detect, and respond to those threats prioritizing talent and operational excellence over the latest technology Portland General Electric | Cybersecurity

Threat modeling practices We study our adversaries through threat modeling We track hacktivism, internal fraud, advanced nation-states, and cyber-crime. Each of the four threat models follows a common process to achieve their goals, known as a kill-chain. By understanding each kill-chain, PGE actively protects against, detects, and responds to threats as efficiently and effectively as possible. While hacktivism, internal fraud, and cyber-crime has increased, advanced nation-state hacking of utilities has grown exponentially. Portland General Electric | Cybersecurity

Critical Infrastructure Attacks STUXNET Nuclear, Iran, 2010 2010 DRAGONFLY Espionage, Middle East, 2013 2013 BLACK ENERGY 2 Various western power companies, reconnaissance, 2015 BLACK ENERGY 3 Ukraine on December 23rd, 2015 2015 CRASH OVERRIDE (ELECTRUM/RUSSIA) THREAT TO ELECTRIC GRID OPERATIONS Ukraine on December 17th, 2016 DRAGONFLY 2.0 US, Switzerland, Turkey 2016-2017 OT assets 2016 DIMEALLOY US, utility reconnaissance 2017 TRISIS Power Safety Systems, 2017 Middle East 2017 Portland General Electric | Cybersecurity

Increasing threat landscape In 2016 and 2017, the significance, volume, and sophistication of critical infrastructure threats from nation-states rapidly increased Utility Data Breaches Attacks Against PGE 900 800 700 600 500 400 300 200 100 25 20 21 15 16 10 10 7 5 China United States Russian Federation Germany Korea 2014 2015 2016 2017 2015 2016 2017 2014-2016 data: Verizon Data Breach Investigation Report (worldwide). 2017: Estimate, Accenture “It’s tempting to believe that this increase in attacks is horizontal across industries, but the data shows that energy organizations are experiencing a disproportionately large increase when compared to other industries.” - Tim Erlin, Director of IT Security and Risk Strategy for Tripwire Portland General Electric | Cybersecurity

Information security roadmap Portland General Electric | Cybersecurity

Quantifying our progress By measuring what we do, we understand how effective our processes are. We measure the maturity of capabilities based on the CMMI model (0-5) We measure operational security and IT metrics We measure risk within our environment and in using vendors through assessment against policy We measure awareness of policy and best practice through training, testing, and surveys We measure our technical attack surface through assessments We measure employee engagement through surveys Portland General Electric | Cybersecurity

Challenges going forward Skilled cyber security resources are in short supply and difficult to attract Aggressive timetable for the Information Security Roadmap Cyber security threats to utilities will continue to increase Change management challenges of instilling a security culture Portland General Electric | Cybersecurity

Thanks For questions please contact Chris Nolke