They are giants standing with their heads held high looking over the vantage point, possibly thinking they are still beyond reach but the sniper in his hoodie has already locked his target on them. The energy sector is not immune to cyber threats and the industry is coming to terms with this fact. The latest attack on a U.S. pipeline network on April 2, 2018 has raised concerns on the risk management scenarios of this industry. The U.S. department of Energy formed the Office of Cybersecurity, Energy Security and Emergency Response aka CESER in February 2018 to supervise the hovering cyber threats. The General Data Protection Regulation (GDPR) and the Directive on Security of Network and Information Systems (NIS) to be implemented in Europe, even accepted by Britain, is expected to empower and mobilize a strong cybersecurity infrastructure.

But is it up to snuff? The energy sector too needs to do its bit and ask itself these questions:

How robust is their data fortress?

Energy companies are generating and transmitting data like any other organization and every bit of it is crucial. Maintaining the confidentiality along with balanced and untampered flow of information requires well-defined data fortification. It is imperative to identify gaps in data security, check the operational support system and prepare guidelines to handle emergencies.

Who is monitoring your control systems?

Maintaining the grid stability especially for the digitally connected network requires well-integrated cybersecurity components. Many companies choose to outsource these network operation services. When choosing a service provider, they must take into account its expertise and experience. There’s also an insider threat looming over your critical data sharing and other operations. Your risk management strategy has to cover all these facets. The energy sector like its finance counterpart had been averse to technology for a long time, hence their traditional architecture still isn’t able to accommodate latest Information and Communications Technology (ICT) components.

Is there a balance between technical and human cyber competence?

An effective information security infrastructure requires not only advanced technology and equipment, but also an equally knowledgeable workforce. In most cases, the detection of a cyber-threat is the make or break factor. If the threat is detected at the right time, you can save the situation or the likelihood of your data being breached. You need a proficient cybersecurity partner or an able in-house team to help analyze, identify, and thwart off any threat before it endangers your business operations.

Are your aware of your cyber acts and rights?

There are lot of them being enacted now and there are some already in place. For the energy sector the devices used as well the technology infrastructure come with certain applied security standards. It is important that your cybersecurity team be acquainted with these components and their interoperability features and limitations in different environments because in some cases you might be operating according to international regulations.

Cyber criminals are rapidly adding cryptojacking to their arsenal and creating a highly profitable new revenue stream, as the ransomware market becomes overpriced and overcrowded, according to Symantec’s Internet Security Threat Report (ISTR), Volume 23.

“Cryptojacking is a rising threat to cyber and personal security,” said Tarun Kaura, Director, Enterprise Security Product Management, Asia Pacific and Japan, Symantec. “The massive profit incentive puts people, devices and organizations at risk of unauthorized coinminers siphoning resources from their systems, further motivating criminals to infiltrate everything from home PCs to giant data centers.”

Symantec’s ISTR provides a comprehensive view of the threat landscape, including insights into global threat activity, cyber criminal trends and motivations for attackers. The report analyzes data from the Symantec Global Intelligence Network, the largest civilian threat collection network in the world, records events from 126.5 million attack sensors worldwide and monitors threat activities in over 157 countries and territories. Key highlights include:

During the past year, an astronomical rise in cryptocurrency values triggered a cryptojacking gold rush with cyber criminals attempting to cash in on a volatile market. Detections of coinminers on endpoint computers increased by 8,500 percent in 2017. India ranks second in Asia-Pacific Japan (APJ) region, ninth globally in terms of crypto mining activities.

With a low barrier of entry – only requiring a couple lines of code to operate – cyber criminals are harnessing stolen processing power and cloud CPU usage from consumers and enterprises to mine cryptocurrency.Coinminers can slow devices, overheat batteries, and in some cases, render devices unusable. For enterprise organizations, coinminers can put corporate networks at risk of shutdown and inflate cloud CPU usage, adding cost.

“Now you could be fighting for resources on your phone, computer or IoT device as attackers use them for profit,” added Tarun. “People need to expand their defenses or they will pay for the price for someone else using their device.”

IoT devices continue to be ripe targets for exploitation. Symantec found a 600 percent increase in overall IoT attacks in 2017, which means that cyber criminals could exploit the connected nature of these devices to mine en masse. Macs are not immune either with Symantec detecting an 80 percent increase in coin mining attacks against Mac OS. By leveraging browser-based attacks, criminals do not need to download malware to a victim’s Mac or PC to carry out cyber attacks. India ranks among the top five countries as source for IoT attacks.

The number of targeted attack groups is on the rise with Symantec now tracking 140 organized groups. Last year, 71 percent of all targeted attacks started with spear phishing – the oldest trick in the book – to infect their victims. As targeted attack groups continue to leverage tried and true tactics to infiltrate organizations, the use of zero-day threats is falling out of favor. Only 27 percent of targeted attack groups have been known to use zero-day vulnerabilities at any point in the past.

The security industry has long discussed what type of destruction might be possible with cyber attacks. This conversation has now moved beyond the theoretical, with one in ten targeted attack groups using malware designed to disrupt.

Symantec identified a 200 percent increase in attackers injecting malware implants into the software supply chain in 2017. That’s equivalent to one attack every month as compared to four attacks the previous year.Hijacking software updates provides attackers with an entry point for compromising well-guarded networks. The Petya outbreak was the most notable example of a supply chain attack. After using Ukrainian accounting software as the point of entry, Petya used a variety of methods to spread laterally across corporate networks to deploy their malicious payload.

Threats in the mobile space also continue to grow year-over-year, including the number of new mobile malware variants which increased by 54 percent. Symantec blocked an average of 24,000 malicious mobile applications each day last year. India also featured amongst the top 10 list of countries where mobile malware was most frequently blocked in 2017. As older operating systems continue to be in use, this problem is exacerbated. For example, with the Android operating system, only 20 percent of devices are running the newest version and only 2.3 percent are on the latest minor release.

Mobile users also face privacy risks from grayware apps that aren’t completely malicious but can be troublesome. Symantec found that 63 percent of grayware apps leak the device’s phone number. With grayware increasing by 20 percent in 2017, this isn’t a problem that’s going away.

In 2016, the profitability of ransomware led to a crowded market. India ranks fourth globally with eight percent of global detections of ransomware. In 2017, the market made a correction, lowering the average ransom cost to $522 and signaling that ransomware has become a commodity. Many cyber criminals may have shifted their focus to coin mining as an alternative to cashing in while cryptocurrency values are high. Additionally, while the number of ransomware families decreased, the number of ransomware variants increased by 46 percent, indicating that criminal groups are innovating less but are still very productive.

As attackers evolve, there are many steps businesses can take to protect themselves. As a starting point, Symantec recommends the following best practices.

For businesses:

• Don’t get caught flat-footed: Use advanced threat intelligence solutions to help you find indicators of compromise and respond faster to incidents.
• Prepare for the worst: Incident management ensures your security framework is optimized, measurable and repeatable, and that lessons learned improve your security posture. Consider adding a retainer with a third-party expert to help manage crises.
• Implement a multi-layered defense: Implement a multilayered defense strategy that addresses attack vectors at the gateway, mail server and endpoint. This also should include two-factor authentication, intrusion detection or protection systems (IPS), website vulnerability malware protection, and web security gateway solutions throughout the network.
• Provide ongoing training about malicious email: Educate employees on the dangers posed by spear-phishing emails and other malicious email attacks, including where to internally report such attempts.
• Monitor your resources: Make sure to monitor your resources and networks for abnormal and suspicious behavior and correlate it with threat intelligence from experts.

On March 27, Bank Negara Malaysia thwarted a cyber heist aimed at carrying out fabricated money transfers through the SWIFT messaging network. As a preventive measure post this incident, the Philippine Central Bank sent across a cautionary notice to all local financial institutions. A similar incident had sent a rude shock to the Central Bank of Bangladesh in 2016. It was a larceny of $81 million that raised questions on the rising power of hackers.

Although there were no financial losses during this cyber attack and payment services or bank operations were not impacted, the warning cannot be ignored. The Philippines Central Bank administers 45 commercial banks and they cannot afford another percussion similar to the Bangladesh Central Bank heist. The funds of the heist were directed into the accounts of Rizal Commercial Banking Corp (RCBC), a manila based firm which was fined $20 million by the Philippines Central Bank.

“We issued a general alert reminder as soon as we got BNM advisory to be extra careful over the long holiday. Although banks already do that as SOP (standard operating procedure),” said Bangko Sentral ng Pilipinas Governor Nestor Espenilla. The Governor also mentioned that information sharing is an enhanced defensive protocol against cyber-crime.