NZ energy sector collaboration needed on cybersecurity

Ransomware remains one of the biggest risks to electricity distributors and other organisations globally.

That’s the view of energy representatives and others involved in Claroty and Vector Technology Solutions roundtables which support collaboration on cybersecurity.

About 350 incidents affecting nationally significant organisations were reported by the New Zealand Cybersecurity Centre in 2021-2022, a rise in attacks since the previous year.

Critical infrastructure providers – such as electricity distributors – should be continuing to evolve in the context of the changing threat landscape (including potential changes to legislative requirements), the discussions heard.

Special guests on the panel included Vector’s chief information security officer Aaron McKeown and Admiral Michael S. Rogers, a retired four-star admiral of the United States Navy who served as the second commander of the United States Cyber Command while also serving as the 17th director of the National Security Agency (NSA) and as chief of the Central Security Service (CSS).

The discussion revealed the pros and cons of new legislation and leveraged Rogers’ experience with US cyber policy to encourage smaller electricity distributors in New Zealand to start discussing their security posture collectively.

Attendees agreed that a sector-based approach in building a secure ecosystem is a critical mechanism to ensure the overall uplift of the industry’s cyber posture.

“Successful breaches into critical infrastructure are ‘not if but when’,” says Rogers.

“Organisations know it’s only a matter of time before attackers get into their networks, but building overall resilience is the key to reducing the damage – specifically, techniques to stop attackers moving laterally throughout the network once inside.”

McKeown says more collaboration is key to uplifting cyber security across the whole energy sector.

“While there are some structured forums such as Control Systems Security Information Exchange (CSSIE) that allow for the sharing of cyber-related information between organisations, informal roundtable discussions like these present an invaluable opportunity for industry leaders to exchange important ideas and insights on the complex cyber security landscape today.”

The three roundtables delivered by cyber-physical systems protection company Claroty and digital solutions business and subsidiary of New Zealand energy company Vector, VTS ,encouraged valuable information sharing and best practice which will benefit the EDBs and cyber posture for the industry.

PowerNet, Electra, Aurora Energy and Unison were among energy companies represented at the talks which covered some key challenges facing New Zealand distribution businesses.

Cyber professionals within energy distribution businesses must continue to perfect the art of communicating risk and threats across all levels of the organisation – from boards to employees, the roundtables heard.

Third-party security poses a significant risk to energy distributors, given there are numerous partners and partner platforms in the energy supply chain, they found.

A “Stop Ransomware Guide” is issued by the US Cybersecurity and Infrastructure Security Agency (CISA).