Report: Electrical grid cybersecurity efforts across U.S. government are 'fragmented'

Over the last four years, the Department of Energy, the Department of Homeland Security and the Federal Energy Regulatory Commission have worked together to implement 27 different electrical grid resiliency programs, which are each designed to address a variety of security concerns.

Though federal efforts remain “fragmented,” the U.S. government has made significant progress in developing policies, programs and technologies that help protect America’s electrical grid, according to a Government Accountability Office report released Friday.

Since 2013, the Department of Energy, the Department of Homeland Security and the Federal Energy Regulatory Commission have worked together to implement 27 electrical grid resiliency programs, which are designed to address a variety of security concerns.

Broadly, the report finds that the level of coordination between these three agencies has also increased in recent years, allowing for better communication with state and private partners in addition to a more effective management of resources.

Most of the electricity grid is owned and operated by private industry.

While some of these individual, agency-specific resiliency programs naturally overlap one another, GAO found no instances of duplication; meaning that tax dollars are not being used to solve the same problems in multiple cases.

“GAO found that the 27 efforts were fragmented in that they were implemented by three agencies and addressed the same broad area of national need: enhancing the resilience of the electricity grid. However, DOE, DHS, and FERC generally tailored their efforts to contribute to their specific missions,” the report reads.

Of the 27 aforementioned programs, 15 were solely focused on strengthening cybersecurity measures. Examples of these efforts include the Energy Department’s Cybersecurity for Energy Delivery Systems Program, which aims to secure energy delivery functions across both legacy and new systems, and the Homeland Security Department’s Resilient Electric Grid Program, which promotes the use of sophisticated technology to improve both reliability and resilience.

This multitude of resiliency programs have offered new ways for the U.S. government to advance relevant emergency response, planning, research, technology development, standard setting and information sharing missions.

“In light of increasing threats to the nation’s electricity grid, national policies have stressed the importance of enhancing the grid’s resilience—its ability to adapt to changing conditions; withstand potentially disruptive events, such as the loss of power lines; and, if disrupted, to rapidly recover,” GAO wrote.

Just three months ago, Ukrainian energy company Ukrenergo experienced a cyberattack that caused widespread blackouts throughout neighborhoods just north of Kiev. Attribution in that case has yet to be made public.

Investigators told Reuters that the attackers were lurking on Ukrenergo’s IT network for at least six months, where they were working to acquire system administrator privileges to control other aspects of the company’s digital infrastructure.

A separate DOE report in January warned that U.S. energy grids are in ”imminent danger” of attack. A power outage caused by a successful future cyberattack could undermine “critical defense infrastructure,” damage the economy and place at risk the safety of U.S. citizens, the agency’s Quadrennial Energy Review noted.

After major Poland energy grid cyberattack, CISA issues warning to U.S. audience

The Cybersecurity and Infrastructure Security Agency said the attack highlighted threats from vulnerable edge devices to operational technology and industrial control systems.

House GOP leaders seek government probe, restrictions on Chinese-made tech

Plankey vows to boot China from U.S. supply chain, advocate for CISA budget

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems