Cybersecurity Isn't Easy When You're Trying to Be Green

Renewable energy companies lag behind their more traditional peers when it comes to the cybersecurity readiness of their infrastructure, raising concerns that attackers targeting critical infrastructure could find easier prey among "green" energy firms.

In a study of 250 energy companies worldwide, oil and natural-gas firms scored the highest — with the average company scoring a 94, or "A" — while the lowest scores belonged to renewable energy companies, which scored a median of 85, or a "B." Green energy firms tend to have distributed generation infrastructure (such as rooftop solar or wind turbines) and are usually more Internet-connected than traditional energy companies — both attributes that can undermine their defensive posture, says Ryan Sherstobitoff, senior vice president for threat research at SecurityScorecard, the cybersecurity risk firm that conducted the study.

Overall, the attack surfaces between traditional energy infrastructure and renewable energy infrastructure can be quite different, he says.

"Oil and gas have legacy technologies, but these legacy technologies are most likely not Internet-facing," Sherstobitoff says. "Whereas the cybersecurity posture of renewable energy may not necessarily be [to the level of other] critical infrastructure itself ... but nonetheless has public-facing portals and other public-facing issues."

The concerns come as the US and other countries invest in green energy infrastructure and scramble to put in place more cybersecurity defenses to protect their critical infrastructure. Nation-state groups have targeted the critical infrastructure of the US and its allies, and while the distributed nature of green energy generation could mitigate widespread outages, their Internet connections represent a weak point, according to the SecurityScorecard report, which was in collaboration with consultancy KPMG.

Distributed Green Systems Harder to Defend

Overall, the energy sector did quite well in the survey of firms. Of the 250 organizations on which data was collected, 81% either scored an A or B. Only 8% of energy firms showed signs of compromise in their external infrastructure, but two-thirds of the breaches were connected to third-party partners, SecurityScorecard reported.

Attacks could prevent renewable energy companies from managing their generation sites to disrupting consumers' power, Sherstobitoff says.

"You could imagine disrupting the ability for these renewable energy devices to connect back and phone home, then you have chaos, because then they can't check in, can't get their status," he says. "If [the infrastructure] depends on getting a status code in order to function, it needs to connect back ... that's another breaking function."

Already, some green energy infrastructure has fallen prey to attackers. Charging stations for electric vehicles typically require connectivity, which makes them vulnerable to both compromise and disruption. In 2022, pro-Ukrainian hacktivists compromised chargers in Moscow to display messages of support for Ukraine. In 2019, a solar firm could no longer manage its 500 megawatts of wind and solar sites in the western US after a denial-of-service attack targeted an unpatched firewall, the FBI stated in a Private Industry Notification (PIN) in July.

The risk could extend all the way to homeowners, who increasingly have adopted rooftop solar and need to be connected to be able to deliver their solar power and be credited.

"This issue will only become more important as small solar systems continue to grow. When every house is a power plant, every house is a target," Morten Lund, of counsel for Foley & Lardner LLP, wrote in a brief directed at energy companies. "In many ways, the distributed nature of solar energy provides significant protection against catastrophic failures. But without sufficient protection at the project level, this strength quickly becomes a weakness."

Third-Party Suppliers Cause Concern

The energy sector is also open to greater third-party risk, with 47% of breaches of energy companies involving a third party, compared with 29% across all industries. In addition, many green energy projects tend to be locally managed or developed by a smaller startup, which could raise risks, especially as the US rushes to adopt more green infrastructure, the FBI stated in its PIN.

"With federal and local legislature advocating for renewable energies, the industry will expand to keep pace, providing more opportunities and targets for malicious cyber actors," the FBI stated.

The US National Strategy for Cyberspace calls out renewable energy as a key industry to defend online. Rich countries tend to have better defenses than poorer economies, as they have better regulations and organizations have more budget to spend on security.

Regulations continue to be the top reason energy firms invest in cybersecurity, with nearly half of companies (49%) citing regulatory requirements among their top three reasons for assigning budget, compared with 38% citing a cybersecurity incident or near miss affecting their company, according to risk management consultancy DNV's "Energy Cyber Priority 2023" report.

"Most renewable sites have not been developed with cybersecurity in mind, but several companies are picking up quickly," says Auke Huistra, DNV Cyber's industrial and operational technology cybersecurity director. "From our engagements, we have seen immature but also mature green energy companies. What we do see is that [cybersecurity gets] more and more attention ... driven by incidents in the industry as well as regulations."