DOE proposes $15M fund to fight energy sector hacks

A proposed $15 million Energy Department fund announced Tuesday looks to improve the cybersecurity posture of the sector’s most vulnerable companies: smaller utility firms with less resources that typically supply energy to municipalities.

A proposed $15 million Energy Department fund announced Tuesday looks to improve the cybersecurity posture of the sector’s most vulnerable companies: smaller utility firms that typically supply energy to municipalities that operate with fewer resources than their bigger counterparts.

“We need game changing innovation in the [electrical grid cybersecurity] space,” Deputy Energy Secretary Elizabeth Sherwood-Randall said Tuesday at a Bloomberg cybersecurity conference in Washington, D.C., Tuesday.

Utility companies across the U.S. — both small and large — are facing a myriad of cyberthreats. But by working together with the U.S. government and industry partners, an improved defensive posture is possible, Sherwood-Randall said.

Industry competitors are already sharing threat intelligence data and other security information amongst themselves and with the federal government, explained Marcus Sachs, senior vice president and chief security officer for the nonprofit North American Electric Reliability Corporation.

The next step is to include more voices in this ongoing and important conversation concerning the physical and digital security of critical U.S. infrastructure, said Suzanne Spaulding, Department of Homeland Security under secretary for the National Protection and Programs Directorate.

The proposed DOE fund, which is subject to congressional appropriations and could be as much as $15 million, will be managed and employed by prominent industry advocacy groups the American Public Power Association and the National Rural Electric Cooperative Association.

Over the next three years, APPA and NRECA — who represent private, municipal utility companies and lobby Capitol Hill on their behalf — will work alongside DOE to develop security tools, educational resources, standard guidelines, training curriculums, assessment processes and information-sharing procedures for their members.

Each organization has a ceiling budget of $7.5 million in federal funding over three years, from July 1, 2016 to June 30, 2019, with an initial allocation of $2,318,969 for the current fiscal year, a DOE spokesperson told FedScoop.

Today, roughly 26 percent of the nation’s electricity customers are served by municipal public power providers and rural electric cooperatives like those represented by the APPA and NRECA, according to the DOE.

Multiple speakers at Tuesday’s event, including former NSA Director Michael Hayden, described the hacking attack on a Ukrainian power utility in December 2015 — which DHS says cut power to 200,000 people — as a watershed moment for both the energy industry and government.

The incident has proven to be useful as a case study for the U.S., according to Sachs, and intelligence agencies have since discovered and diagnosed the malware used in the breach.

NERC runs a phishing simulation against energy providers that emulates aspects of the Ukrainian attack so that companies can learn how to avoid similar mistakes, Sachs said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure