The cost of expected cybersecurity mandates: bigger energy bills for consumers

Biden's forthcoming cybersecurity strategy is expected to introduce regulations for utilities that could increase consumers' energy bills.

The Biden administration’s forthcoming national cybersecurity strategy is widely expected to call on utility operators to invest more on cybersecurity protections to guard against malicious hackers who are increasingly targeting critical infrastructure.

And that will mean consumers will end up footing the bill for those added protections, said Bill Fehrman, CEO of Berkshire Hathaway Energy, at the annual S4x23 ICS conference in Miami on Wednesday.

Fehrman, who is co-chair of the influential Electric Subsector Coordinating Council, said that utilities are investing in more clean energy initiatives and any new mandates to increase digital defenses from the administration will be difficult for power companies to absorb.

His comments at the S4 conference, a gathering of professionals and policymakers focused on the security of industrial systems, comes as the broader cybersecurity industry is awaiting the highly anticipated national cybersecurity strategy from President Biden. According to people who have seen advanced copies of the plan, it is expected to call for cybersecurity regulations for critical infrastructure operators.

The added costs that come with expected cybersecurity regulations will be “above and beyond what those companies are able to absorb and so I think there will be increased costs because of security,” said Fehrman. “But it’s a cost of doing business in the end.”

As more pressure grows on electric utilities to prioritize cybersecurity, that also means shifting away from the common industry practice to buying the lowest cost components, said Fehrman. Instead, he said, utilities should shift to buying the lowest-risk option.

Fehrman did say that overall cybersecurity information sharing between the utility sector and the government is improving, a development he said will help improve the industry’s overall approach to defending against digital threats.

“We’re on the frontlines, we’re gathering all the data. We don’t know what to do with it. We can hand it off right to the intelligence community, they know what to do with it, they can give us immediate feedback,” Fehrman said. “Then we have this sharing and much faster transfer of information so that we can actually put actionable items into into practice.”

Bipartisan Senate bill aims to prepare energy sector for Q-Day

Under the bill, FERC would consider cyber threats from quantum computers and post-quantum cryptography in its reliability standards for the energy sector. 

Industry’s message on CIRCIA: Please ask us fewer questions about cyberattacks

House intel bill includes provisions on state and local threat intelligence, election security, AI

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure