Power outtage trivial compared to directed cyberattack

This week’s power outage affecting one million in UK will seem trivial if a cyberattack hits electricity networks, according to new research from the UK Infrastructure Transitions Research Consortium (ITRC).

Last weekend saw around one million people in England and Wales affected by power outages due to two generators shutting down simultaneously. Power was restored after two hours. However, this will likely seem insignificant next to the effects of a cyberattack on a power network, which could lead to significantly longer power outages, says ITRC infrastructure researcher Dr Edward Oughton.

Cyberattacks on London electricity networks could disrupt 1.5 million people upwards, he warns. “Critical national infrastructure such as smart electricity networks are susceptible to malicious cyberattacks which could cause substantial power outages and cascading failure affecting multiple business, transport, health and education organisations as well domestic supply,” comments Edward Oughton.

Potential cyberattacks on electricity networks could cost some £111M a day, and such attacks are likely to become more and more prevalent.
In 2015, a cyber-physical attack took place on the Ukrainian electricity distribution network, leading to a loss of power for 225,000 people. A Worldwide Threat Assessment of the US Intelligence Community report published earlier this year also notes that “China, Russia, Iran, and North Korea increasingly use cyber operations to threaten both minds and machines in an expanding number of ways—to steal information, to influence our citizens, or to disrupt critical infrastructure.”

GDP losses from a similar sized attack in London, published in a new paper, “Cyber-Physical Attacks on Electricity Distribution Infrastructure Networks”, in the Risk Analysis journal show conservative scenarios ranging from £20.6M for a four-substation electricity event to £111.4M for a 14-substation electricity event.

Even though the research focused on conservative scenarios similar in size to the Ukrainian attack, the paper demonstrates that 1.5 million people would be affected even by a relatively small attack.

Until Edward and fellow researchers carried out this study, little was known about the effects and costs of cyber-physical attacks on electricity networks. Such networks are proving to be a point of failure which many people previously thought impermeable.

“The research will be of interest to governments, private infrastructure operators, commercial consumers of infrastructure services and other stakeholders who want to understand systemic risks from cyber-physical attacks on Critical National Infrastructure”, said Professor Daniel Ralph of the Cambridge Centre for Risk Studies.

Edward explains, “Cyberattacks are on the increase and gathering data and modelling the effects of such cyber-physical attacks is essential to develop risk analytics for emerging threats on Critical National Infrastructure (CNI).”

Modelling impacts on electricity infrastructure and economy

The paper uses the United Kingdom as a case study and identifies:

• The direct impact on household and business consumers of power
• The indirect impact of a cyber-physical attack to infrastructure beyond electricity
• A greater understanding of systemic risk arising from cyber and smart energy systems.

The research demonstrates that these types of attacks on electricity distribution substations could lead to further indirect infrastructure cascading failure across telecoms, fresh water supply, waste water and even railways. Economic impacts and disruptive effects to consumption, labour supply and business confidence are also highlighted, identifying impacts on GDP, capital stock, investment, and other indicators.

“Stochastic Counterfactual Risk Analysis for the Vulnerability Assessment of Cyber-Physical Attacks on Electricity Distribution Infrastructure Networks”. Risk Analysis. Edward J. Oughton, Daniel Ralph, Raghav Pant, Eireann Leverett, Jennifer Copic, Scott Thacker, Rabia Dada, Simon Ruffle, Michelle Tuveson, Jim W Hall. https://onlinelibrary.wiley.com/doi/full/10.1111/risa.13291

If you would like to read more articles like this then please click here.

The post Power outtage trivial compared to directed cyberattack appeared first on UK Construction Online.