From cyber fear to grid resilience

On December 23, 2015, an operator at a power distribution control center in western Ukraine watched in disbelief as his cursor began moving on its own. Miles away, attackers had taken remote control of the system and were opening circuit breakers across several substations. When he tried to stop them, he was abruptly locked out after his password was changed.

The coordinated attack affected three electricity distribution companies. Thirty substations were taken offline, interrupting service to approximately 225,000 customers. The incident became the first confirmed cyberattack against an electricity network to affect system availability.

For utilities, the attack brought a distant cyber threat into the physical world. A compromised system could interrupt electricity, interfere with grid equipment and obstruct the people trying to restore service.

More than a decade later, that lesson carries greater urgency. Power networks are becoming more distributed, dynamic and data-intensive. Utilities are connecting renewable generation, energy storage, electric vehicles and AI datacenter large load demands while managing aging infrastructure and growing expectations from customers, regulators and governments.

Digital substations help operators navigate that complexity. Information from protection, control, automation and asset-monitoring systems can reveal developing equipment problems, support faster responses to faults and equipment failure allowing operations teams to focus limited maintenance resources where they are needed most.

Every connection that serves this important grid information and enables these asset monitoring capabilities also deserves careful protection.

A modern substation may contain intelligent electronic devices for protection and control, remote terminal units, gateways, engineering workstations, human-machine interfaces, SCADA platforms and asset-monitoring applications.

These technologies exchange the information required to protect equipment and control power flows. They also connect operational technology with wider utility systems, creating possible paths for attackers to penetrate the system.

A phishing email may seem far removed from a circuit breaker. The distance can narrow quickly if an attacker obtains credentials, enters an enterprise IT network and traverse into the operational systems.

The Ukraine attack demonstrated the consequences of unauthorized access to operational systems. The following year brought evidence of an even more specialized threat.

CrashOverride, also known as Industroyer, was reportedly deployed against Ukrainian critical infrastructure in December 2016. The modular malware framework included payloads supporting industrial communication protocols used in electric-power systems, including IEC 60870-5-101, IEC 60870-5-104 and IEC 61850. According to CISA, the framework could use legitimate control-system functions to communicate with field equipment and operate switches and circuit breakers. It also included a denial-of-service component capable of exploiting a vulnerability in protection devices. 

The malware was designed to exploit functions already present in the control environment. Equipment could therefore respond to a technically valid command even when the command originated from unauthorized or malicious software.

That distinction matters. Utilities are protecting more than devices and networks; they are also protecting the authorization and integrity of operational commands and decisions.

The attacks in Ukraine remain exceptional because they caused a documented interruption to electricity service. The wider pattern, however, is troubling.

An International Energy Agency analysis published in August 2023 found growing evidence that cyberattacks against utilities had risen rapidly since 2018 and reached particularly high levels in 2022. The IEA also cited incidents that disabled remote control of wind farms, disrupted prepaid meters when IT systems became unavailable and exposed customer information, including names, addresses, bank account details and phone numbers. 

No reliable global count captures every attack against power grids or substations. Some incidents go unreported, others remain undetected, and definitions vary across organizations and jurisdictions. Public figures therefore provide an incomplete picture of utility exposure. 

The financial consequences can still be substantial. An IBM study cited by the IEA placed the average cost of an energy-sector data breach at USD 4.72 million in 2022. The figure covers the broader energy sector rather than operational technology or substations alone, but it illustrates the cost of investigation, containment, recovery, information loss and business disruption. 

For a utility, the balance sheet tells only part of the story. A serious incident can affect service continuity, worker safety, regulatory standing, organizational reputational damage and public trust. Electricity also supports communications, healthcare, transportation, water and other essential services, extending the potential impact far beyond the affected network.

Utilities already operate within demanding regulatory environments. In North America, the NERC Critical Infrastructure Protection standards establish enforceable cybersecurity requirements for responsible entities.

The standards define outcomes that utilities must achieve and document. Each responsible entity determines how those requirements apply to its systems and operations.

Products and technical solutions can support a NERC CIP compliance program, but accountability remains with the regulated utility. Configuration, access, maintenance, documentation and operational processes all influence the security of the overall system.

Technical standards add further depth. IEC 62443 provides a framework for industrial automation and control system security that is also applicable to similar electric energy operational technology control systems. IEC 62443-2-4 addresses the security programs of service providers involved in integration and maintenance. IEC 62351 covers power-system communications, while IEEE 1686 address security capabilities for intelligent electronic devices.

These frameworks help engineering, operations, IT, cybersecurity and procurement teams work from shared requirements. They also support more informed conversations with equipment manufacturers, system integrators and service providers.

Compliance confirms that required measures are in place. Resilience becomes visible when an organization can identify and contain an incident, preserve critical functions, operate safely under degraded conditions and restore affected systems.

A clear view of the operational environment is the starting point. Utilities need to know which assets are connected, how information moves between them, who requires access and what could happen if a device or communication path were compromised.

Defense in depth distributes protection across the architecture. Network segmentation places assets into defined security zones. Firewalls, secure gateways and electronic access points govern communication between them. Encryption and message-integrity controls protect data in transit. Role-based access limits users and applications to the functions they require.

Devices capable of operating circuit breakers require particular attention. A strong Defense-in-Depth architecture with multiple security layers, tightly controlled access and effective monitoring make those assets harder to reach and misuse.

The design must also respect the physics and timing of the power system. Protection and control applications depend on fast, dependable communications. Encryption, inspection and monitoring consume processing capacity and bandwidth and can add latency. Security controls must therefore be engineered around operational performance, availability and recovery requirements.

This work is strongest when power-system engineers and cybersecurity specialists solve the problem together. Each brings a different understanding of risk. One sees attack paths and vulnerabilities; the other understands how timing, system behavior and equipment constraints affect reliable operation.  It is a true balance of reliability and security and the ultimate security of an air gap solution prevents the benefits of information required to drive higher levels of reliability.

Commissioning captures the condition of a system on one day. Software changes, configurations evolve and new vulnerabilities continue to emerge.

Utilities need repeatable processes for maintaining asset inventories, reviewing access, monitoring systems, evaluating vulnerabilities, managing patches and testing recovery plans.

Patch management illustrates the challenge. Delaying an update can leave a known vulnerability exposed. Deploying it without sufficient assessment can affect compatibility or availability. A sound decision considers the severity of the vulnerability, the role of the affected asset, available mitigations and the operational conditions required for safe implementation.

Manufacturers and system integrators contribute through secure lifecycle development, vulnerability notifications, patches, mitigation guidance and lifecycle support. Utilities must relate that information to their own installed base and operational priorities. Supplier transparency and long-term support consequently belong in procurement and investment decisions.

For publicly owned utilities, cyber resilience supports continuity of essential services and responsible stewardship of community resources. For privately owned utilities, it protects operations, regulatory standing, financial performance and customer confidence. Both serve people who expect electricity to be available when they need it.

Digital substations provide the visibility and control utilities need to manage a more complex grid. Their security will depend on thousands of decisions made across design, procurement, operations and maintenance.

Handled well, those decisions allow utilities to modernize with confidence and keep reliability where it belongs: at the center of the system while managing the cybersecurity challenges.

1. International Energy Agency, Power Systems in Transition: Cyber Resilience, published October 27, 2020. The report identifies the December 23, 2015 Ukraine incident as the first confirmed cyberattack against an electricity network to affect system availability, with 30 substations taken offline and approximately 225,000 people losing power.
2. Cybersecurity and Infrastructure Security Agency, The Power of Resilience, released August 9, 2023. CISA’s account describes attackers remotely manipulating substation circuit breakers, changing an operator’s password and striking three power distribution centers. It uses a later estimate of more than 230,000 people affected.
3. Cybersecurity and Infrastructure Security Agency, CrashOverride Malware, Alert TA17-163A, originally issued June 12, 2017 and last revised July 20, 2021. The alert describes malware reportedly used against Ukrainian critical infrastructure in 2016, including modules targeting IEC 101, IEC 104 and IEC 61850.
4. International Energy Agency, Cybersecurity: Is the Power System Lagging Behind?, published August 1, 2023. The analysis reports growing evidence that cyberattacks against utilities had risen rapidly since 2018 and reached particularly high levels in 2022. It also notes that available data is limited by underreporting and incomplete detection.
5. International Energy Agency, Cybersecurity: Is the Power System Lagging Behind?, published August 1, 2023. The commentary cites examples of cyber incidents disabling remote control of wind farms, affecting prepaid-meter services and exposing customer information. Read the IEA commentary. [iea.org]
6. IBM Security and Ponemon Institute, Cost of a Data Breach Report 2022. The research studied 550 organizations affected by breaches between March 2021 and March 2022 across 17 countries or regions and 17 industries. The IEA cites its finding that the average cost of an energy-sector data breach reached USD 4.72 million in 2022. View the 2022 report.