Recognizing the critical importance of securing the operational technologies (OT) that manage and operate essential energy systems, such as electricity, oil, and natural gas, G7 nations have decided to develop a collective cybersecurity framework focused on these technologies. On the very same day, the G7 announced its plan, the U.S. Department of Energy (DOE) issued a new set of Supply Chain Cybersecurity Principles that concentrate on foundational actions and approaches necessary for global energy supply chains to build energy automation and industrial control systems (ICS), to have stronger cybersecurity posture.
The G7 initiative will improve the security and resilience of global supply chains of key energy sector technologies, ensuring appropriate levels of cybersecurity throughout the process of manufacturing relevant technologies.
The G7 Cybersecurity Framework is geared toward establishing one standard and a set of practices to help manage globally sourced cybersecurity risks. The framework provides for collaboration, sharing between countries, risk management, and resilience and supports manufacturers and operators in designing and adopting appropriate risk management measures while being effective in cybersecurity.
The move also builds on the work of the White House Council on Supply Chain Resilience to strengthen supply chains that are critical to America’s economic and national security. It also builds upon the efforts of the DOE and Idaho National Laboratory which have brought tremendous expertise to bear in securing OT infrastructure to date.
The G7 initiative will develop a global cybersecurity framework that will guide energy systems for global coordination, protection of critical infrastructures, enhancement of resilience, and supporting innovation. The framework will achieve harmonization across major economies, ensure that the energy systems recover quickly enough in case any cyber incident happens, and provide security for the deployment of new technologies in the energy sector.
The Supply Chain Cybersecurity Principles are focused on holistic risk management approaches to counter potential cybersecurity threats. Principally, they urge manufacturers and operators to collaborate with vendors in planning robust incident response and recovery strategies for enabling continuous monitoring that allows them to detect and respond to cyber threats in near real-time. This is coupled with regular communication, conducting drills, and updating measures of cybersecurity.
Clearly, the initiative by the G7 to deliver a collective cybersecurity framework, along with new Supply Chain Cybersecurity Principles from the U.S. DOE, is therefore very much in the right direction toward the security and resilience of global energy systems. Taken together, the G7 nations wish to improve the energy landscape in such a way that it becomes more secure not only for manufacturers and operators but for all people in general.
Industrial Cyber reached out to industrial cybersecurity experts to examine the factors that led to the launch of the global initiative to enhance cybersecurity in energy supply chains. They also focused on the current cybersecurity threats facing energy supply chains.
“During the 50th G7 Summit last month, leaders committed to focus on building more cyber resilient democratic societies. Part of the focus includes energy because it powers our economies,” Paul Griswold, chief product officer for cybersecurity at Honeywell Connected Enterprise (HCE), told Industrial Cyber. “However, cybersecurity intrusions and attacks, particularly with malware, continue to accelerate against the energy sector and supply chains because they can cause significant economic disruption.”
Gajen Kandiah, president and COO of Hitachi Digital, chairman of Hitachi Cyber, and deputy general manager for Hitachi’s AI Transformation division, told Industrial Cyber that the frequency and sophistication of cyberattacks in the energy sector – from ransomware attacks that can halt operations and cyber espionage campaigns aimed at stealing sensitive information to cyberattacks designed to sabotage energy production or disruption – is increasing.
He added, “Further, the expanding digitalization of the industry, which modernizes and transforms energy delivery, and the resulting interconnectedness of modern energy infrastructure introduces additional cybersecurity risks as a breach in one area could spread to others, making the entire system vulnerable to widespread disruption.”
The executives highlighted the primary goals and objectives of the initiative and discussed the major challenges in coordinating a global cybersecurity effort for energy supply chains.
Griswold said that the members of the initiative intend to strengthen cybersecurity and build resilience for the energy sector with systems in key areas, such as extraction, production, and distribution. “This includes developing a comprehensive cybersecurity framework tailored for energy supply chains that establishes best practices for the sector and protects OT assets while ensuring compliance with relevant cybersecurity standards and regulations.”
He added that a massive challenge is that the energy sector is very complex and interconnected across countries. “Not only that, but individual companies have incredibly complex energy ICS that contain components produced from suppliers around the world, leading to increased risks of vulnerabilities and more complicated software supply chains.”
“The White House’s global initiative sets out to establish a collective cybersecurity framework and principles for operational technologies for both manufacturers and operators and builds upon existing efforts to strengthen and secure critical energy supply chains,” Kandiah noted. “Announced in mid-June, the Department of Energy’s Supply Chain Cybersecurity Principles aim to promote and drive best practices, facilitate the sharing of threat intelligence, foster international collaboration, and provide robust incident response strategies.”
He added that the biggest challenges lie in aligning the diverse interests and capabilities of various stakeholders. “There are also the issues of keeping pace with rapidly evolving cyber threats and ensuring all parts of the supply chain ecosystem have the resources and knowledge necessary to maintain robust cybersecurity defenses.”
The executives explained how the initiative would overcome the vulnerability of their energy supply chains and also shared plans for training and resources that would be made available to companies for the enhancement of their cybersecurity postures.
“A major way is by increasing the level of cooperation with the establishment of a new G7 Cybersecurity Working Group,” according to Griswold. “The G7 governments said they will encourage manufacturers to build more secure products and solutions.”
Kandiah mentioned that the initiative will employ risk assessments, implement advanced cybersecurity technologies, and conduct regular audits to address vulnerabilities. “Training will be available on threat detection, incident response, and cybersecurity best practices. Additionally, to help organizations improve their security posture, toolkits and guidelines will be provided and access to a global network of cybersecurity experts offered,” he added.
The executives discussed the technologies and innovations currently being used to gain better cybersecurity across energy supply chains, including the metrics that will measure success over time.
Griswold identified that many companies are implementing advanced monitoring and detection solutions from established cybersecurity vendors, who are increasingly using AI for threat detection and cyber operational efficiencies. “The G7 also wants to promote the development, adoption, and recognition of cyber-safe Internet of Things (IoT) solutions in the energy sector,” he added.
“The initiative leverages technologies like real-time monitoring and anomaly detection as well as AI, machine learning, blockchain, and advanced encryption methods for threat detection and mitigation,” Kandiah observed. “Metrics include the reduction in successful cyber-attacks, speed of threat detection and response, compliance rates with cybersecurity frameworks, and overall improvement in cybersecurity maturity levels across the energy sector.”
The executives focused on how the initiative plans to stay ahead of evolving cyber threats and discussed the importance of international cooperation and collaboration for the success of this initiative.
“At the same time the G7 announced the global initiative, other countries have announced expanded national programs,” Griswold pointed out. “The U.S. Department of Energy released a new set of Supply Chain Cybersecurity Principles focused on best practices for ensuring robust cybersecurity in the energy sector, particularly with ICS and supply chains.”
He added, “We will see complementary principles in some countries, but I believe there will be increased cooperation as we share similar practices.”
Kandiah identified that critical to staying ahead of evolving cyber threats is a dynamic and proactive approach to cybersecurity – from continuous monitoring of the threat landscape and regular updates to cybersecurity practices and technologies to ongoing innovation of cybersecurity solutions and training for stakeholders.
He added that international cooperation, particularly around threat intelligence, joint training exercises, and harmonized cybersecurity standards, is critical to foster a unified approach and drive success for the initiative.
