Keeping the Lights on in a Dangerous World Adam S. Lee, Vice President and CSO Dominion Energy January 11, 2019

Dominion Energy: Who We Are January 11, 2019 January 11, 2019

Ukraine 2015 and 2016 Outages 2015 cyberattack against electric distribution Outage for 225,000 customers Attack against multiple utilities Numerous cyber related attack techniques 2016 cyberattack against electric transmission Tailored ICS malware, uses the ICS system capabilities to perform its work Source: https://dragos.com/blog/crashoverride/ CrashOverride-01.pdf Source: https://ics.sans.org/media/E-ISAC_SANS_Ukraine_DUC_5.pdf January 11, 2019

Russia’s Threat to Energy Sector Dragonfly 2.0 targeted grid operators, power generators, pipeline operators, equipment providers (Source: Symantec) US-CERT Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors Used many cyberattack techniques, tactics, and procedures (TTPs) Targeted industrial control systems Source:www.symantec.com/blogs/threat-intelligence/dragonfly-energy-sector-cyber-attacks January 11, 2019

Energy is a key aspect of China 2025 Plan Made in China 2025 Electrical equipment, energy saving, and new energy vehicles Smart grids as an area to improve its research and development Intellectual Property theft / economic espionage May 2014 – hackers targeting U.S. nuclear power, metals and solar products industries December 2018 – hackers who were part of APT10 with conspiracy against the oil and gas sector and a national energy research laboratory Intellectual Property theft / economic espionage May 2014 indictment of five Chinese military hackers for activities targeting U.S. nuclear power, metals and solar products industries December 2018 indictment of two Chinese hackers who were part of APT10 with conspiracy to commit computer intrusions, conspiracy to commit wire fraud, and aggravated identity theft including against the oil and gas sector and a national energy research laboratory https://supchina.com/2018/06/28/made-in-china-2025/ :https://www.uschamber.com/sites/default/files/final_made_in_china_2025_report_full.pdf Source: https://www.justice.gov/opa/pr/us-charges-five-chinese-military-hackers-cyber-espionage-against-us-corporations-and-labor https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion January 11, 2019

Kinetic Attacks 2013 Metcalf substation attack Communications infrastructure - fiber cuts Sniper shoots at equipment in station Damage to transformers and circuit breakers No outage to customers $15 million in damage Source: http://www.cpuc.ca.gov/uploadedFiles/CPUC_Website/Content/Safety/Presentations_ for_Commission_Meeting/SafteySlidesfromPowerPointforthe22714Meeting3331.pdf https://www.wsj.com/articles/assault-on-california-power-station-raises-alarm-on-potential-for-terrorism-1391570879?tesla=y January 11, 2019

Domestic Terrorism/ Environmental Extremism Environmental activists Attempts to disrupt or prevent building of infrastructure Protests against existing generation (e.g., coal plants) Extremists against land use: NIMBY (Not in my backyard) https://www.greenpeace.org/usa/news/ greenpeace-activists-climb-coal-elevator-at-bridgeport-coal-plant/ Block construction paths / damage construction equipment Tampering with pipeline valves Attaching themselves to construction equipment Source: https://www.washingtontimes.com/ news/2016/oct/27/authorities-begin-removal-dakota-access-protest-ca/ January 11, 2019

Disruptive Weather: Hurricanes/ Tropical Storms, Ice, Wind 2011 Irene: 1.2 million customers impacted 2012 Super Derecho: 1.0 million customers impacted 2018 Wind Storm: 690,000 customers impacted 2018 Tropical Storm Michael: 600,000 customers impacted January 11, 2019

Risk-based Approach Assess Risk Analyze Threat Intelligence Assess Posture & Identify Gaps Implement Capabilities Continuous Monitoring Incident Response/ Recovery January 11, 2019

Philosophy Defense-in-Depth Resilience-in-Depth Multiple layers of defense Continually asking “what if” an attacker gets past a line of defense Layers of defense aligned with risk profile Resilience-in-Depth Identify critical single points of failure or exposure Design redundancy, fault tolerance, and recovery capabilities Layers of resilience aligned with risk profile January 11, 2019

Threat Intelligence and Information Sharing Within Industry Active participants in industry information sharing and analysis centers (ISACs) Industry and regional peer groups Industry trade associations Private – Public Partnerships Intelligence Community Federal, state and local law enforcement U.S. Department of Energy January 11, 2019