7 Predictions for Global Energy Cybersecurity in 2022

We now live in a world where cyberattacks can shut down critical infrastructure. Those who follow the mega-trends driving the global economy — like the convergence of the digital revolution and the energy transition — understand that with more and more critical infrastructure remotely operated or digitally managed, it was only a matter of time before a cyberattack caused disruptions that crossed over into the physical world. Last year, I wrote that 2021 would "shine a light on the need for industrial cybersecurity."

Sure enough, a ransomware attack on the Colonial Pipeline operators prompted a weeklong shutdown, cutting nearly half of liquid fuel supplies for the eastern United States. Gas prices spiked, more than 10,000 gas stations ran out of fuel, and the targeted company paid $4.4 million in ransom. Federal and state governments stepped in to soften the economic impact, offering a $10 million reward to identify the individuals who perpetrated the attack.

These are predictable consequences of today's cybersecurity landscape. For companies hoping to avoid the uncomfortable spotlight that comes with being this year's object lesson in cyber vulnerabilities, it's worth stepping back to consider the broad trends driving cyberattacks and the new horizons in cyber defense.

For years, the drive for business efficiencies and lower carbon emissions has incentivized digitalization. And while digitalization is often associated with newer technologies like electric cars, grid-scale solar and wind, and smart city infrastructure, retrofits of existing pipelines, thermal plants, and factories are just as prevalent. Previously analog systems are now digitally automated. Remote operations allow a handful of workers to centrally manage several worksites.

All this progress relies on the huge and growing number of smart devices embedded in electric grids and industrial supply chains. Chief information security officers, or CISOs, need to keep up with the scale of change and recognize that cyber defense is no longer focused on stacks of servers and personal computers.

Here's the good news: Today's cyber defenders can take advantage of an ecosystem of technical solutions and information-sharing. Even as threats continue to evolve, defenses can respond faster than ever — if they're built with adaptability in mind. Getting these defenses right unlocks a huge set of technologies that enable greater efficiency, greater productivity, and lower emissions.

As organizations grapple with what 2022 will bring, here are seven trends to expect.

1. More Attacks
Most industries should now be thinking about cyberattacks the way we think about hurricanes: They're going to happen, so prepare accordingly. Making a plan and practicing your playbook can help your organization withstand a hit. Cybersecurity should be part of design parameters, not a tack-on.

2. More Industrial IoT
Major business benefits flow from blurring the lines between information technologies (IT) and operational technologies (OT) like turbines, manufacturing equipment, or charging stations. Building an industrial Internet of Things (IoT) can make a team nimble, efficient, and customer responsive. Ever-expanding industrial IoT will need robust cybersecurity or reliability will suffer.

3. Emphasis on Sustainability
As organizations around the world seek low-carbon solutions, more systems will go all-electric, and more will be digitally managed to optimize efficiencies. As we have seen with the dramatic transition in the energy sector, increased digitization makes strong cybersecurity even more important. Expect major investors to scrutinize climate, environmental, and cybersecurity risks when considering whether to finance projects.

4. More Discussions in Board Rooms
Thanks to an explosion in remote work and the growth of IoT, cybersecurity is a core business competency for more organizations than ever. Boards and investors will be asking how companies are handling cybersecurity risks.

5. More Artificial Intelligence
It's no secret that cybersecurity calls for monitoring millions of data points, day in and day out. Automation is getting smarter about handling context that until this year required human intelligence. Shifting routine, high-volume monitoring from humans to machines has big advantages. Automation to detect a threat can move at the speed of electrons. But perhaps more important, automation frees up human analysts to hunt threats and investigate anomalies, the actions needed to discover novel threats in their earliest stages.

6. More Government Involvement
High-profile attacks like the 2021 Colonial Pipeline breach bring government attention. Critical infrastructure is now a frequent target of sophisticated attackers — some of whom have foreign government backing themselves. More companies will need to demonstrate to home governments that they are providing competent defenses. More governments will be making efforts to require mature cybersecurity and ensure that regulations provide a floor and not a ceiling for strong, innovative defenses. Finding the right balance of funding, incentives, and regulations will be an ongoing challenge.

7. Less Brute Force, More Monitoring and Detection
The surefire way to stop an attacker from pillaging a corporate network is to shut down everything. But this brute-force solution is expensive. Monitoring internal systems to detect threats and retrace their sources can provide companies with more nuanced options — potentially the difference between shutting down a single compromised wind turbine or a whole wind farm. Right-sizing a response minimizes costs and can make leaders more amenable to precautionary or preemptive action.