1. Keeping the Lights on in a Dangerous World
Adam S. Lee,
Vice President and CSO
Dominion Energy
January 11, 2019

2. Dominion Energy: Who We Are
January 11, 2019
January 11, 2019

3. Ukraine 2015 and 2016 Outages
2015 cyberattack against electric distribution
Outage for 225,000 customers
Attack against multiple utilities
Numerous cyber related attack techniques
2016 cyberattack against electric transmission
Tailored ICS malware, uses the ICS system capabilities to perform its work
Source: CrashOverride-01.pdf
Source:
January 11, 2019

4. Russia’s Threat to Energy Sector
Dragonfly 2.0 targeted grid operators, power generators, pipeline operators, equipment providers (Source: Symantec)
US-CERT Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors
Used many cyberattack techniques, tactics, and procedures (TTPs)
Targeted industrial control systems
Source:
January 11, 2019

5. Energy is a key aspect of China 2025 Plan
Made in China 2025
Electrical equipment, energy saving, and new energy vehicles
Smart grids as an area to improve its research and development
Intellectual Property theft / economic espionage
May 2014 – hackers targeting U.S. nuclear power, metals and solar products industries
December 2018 – hackers who were part of APT10 with conspiracy against the oil and gas sector and a national energy research laboratory
Intellectual Property theft / economic espionage
May 2014 indictment of five Chinese military hackers for activities targeting U.S. nuclear power, metals and solar products industries
December 2018 indictment of two Chinese hackers who were part of APT10 with conspiracy to commit computer intrusions, conspiracy to commit wire fraud, and aggravated identity theft including against the oil and gas sector and a national energy research laboratory :
Source:
January 11, 2019

6. Kinetic Attacks 2013 Metcalf substation attack
Communications infrastructure - fiber cuts
Sniper shoots at equipment in station
Damage to transformers and circuit breakers
No outage to customers
$15 million in damage
Source: for_Commission_Meeting/SafteySlidesfromPowerPointforthe22714Meeting3331.pdf
January 11, 2019

7. Domestic Terrorism/ Environmental Extremism
Environmental activists
Attempts to disrupt or prevent building of infrastructure
Protests against existing generation (e.g., coal plants)
Extremists against land use:
NIMBY (Not in my backyard)
greenpeace-activists-climb-coal-elevator-at-bridgeport-coal-plant/
Block construction paths / damage construction equipment
Tampering with pipeline valves
Attaching themselves to construction equipment
Source: news/2016/oct/27/authorities-begin-removal-dakota-access-protest-ca/
January 11, 2019

8. Disruptive Weather: Hurricanes/ Tropical Storms, Ice, Wind
2011 Irene: 1.2 million customers impacted
2012 Super Derecho: 1.0 million customers impacted
2018 Wind Storm: 690,000 customers impacted
2018 Tropical Storm Michael: 600,000 customers impacted
January 11, 2019

9. Risk-based Approach Assess Risk Analyze Threat Intelligence
Assess Posture & Identify Gaps
Implement Capabilities
Continuous Monitoring
Incident Response/ Recovery
January 11, 2019

10. Philosophy Defense-in-Depth Resilience-in-Depth
Multiple layers of defense
Continually asking “what if” an attacker gets past a line of defense
Layers of defense aligned with risk profile
Resilience-in-Depth
Identify critical single points of failure or exposure
Design redundancy, fault tolerance, and recovery capabilities
Layers of resilience aligned with risk profile
January 11, 2019

11. Threat Intelligence and Information Sharing
Within Industry
Active participants in industry information sharing and analysis centers (ISACs)
Industry and regional peer groups
Industry trade associations
Private – Public Partnerships
Intelligence Community
Federal, state and local law enforcement
U.S. Department of Energy
January 11, 2019