Critical infrastructure today suffers from both antiquated infrastructure and enormous vulnerabilities caused by information and operational technology. Over the past decade and more, critical infrastructure, in particular electric utilities, have been grasping with how to provide a secure, effective and efficient operational and administrative infrastructure, while continuing to operate an infrastructure that is old, patch worked and linked via new technology that provides some advancement yet introduces potential vulnerabilities. These vulnerabilities can be and are being used by malicious actors as well as inadvertently by workers. 

These issues have been highlighted numerous times by governments, cybersecurity professionals, utilities and even users of the electric grid. Increased visibility into these issues has led to an increase in regulatory action and identification of best practices. However, they have not been successful to date as seen by some of the following reports: 

“Widespread disruption of electric service because of a transmission failure initiated by a cyber-attack at various points of entry could undermine U.S. lifeline networks, critical defense infrastructure, and much of the economy; it could also endanger the health and safety of millions of citizens.” – Department of Energy

(…)