The emergency closure of an unidentified UK power generation facility following a cyber attack linked to the Iranian regime has highlighted some of the resilience challenges facing operators of critical national infrastructure (CNI) – particularly those that fall below regulatory incident reporting thresholds.
First reported by the Telegraph on Saturday 22 August, the shutdown is understood to have lasted four days, and took place at roughly the same time as a series of well-publicised incidents affecting water infrastructure in the US.
According to the newspaper the affected power plant was a smaller, so-called ‘peaker’ facility held in reserve – often to top up electricity supplies at times of heightened need. As such the incident did not cause disruption to the UK’s national grid or energy supply and went largely unobserved at the time. Additionally, officials told the media that there were thresholds above which major power facilities must legally report cyber activity, which this incident had not technically passed over.
Nevertheless the incident has been reported to and is being investigated by the National Cyber Security Centre (NCSC), while the UK government has moved to brief sector organisations and offered guidance on enhancing resilience.
“Plans are in place to ensure the resilience of UK energy supply in the highly unlikely event of significant disruption, regardless of the cause,” a spokesperson said.
Bridewell chief technology officer Martin Riley said the attack on the plant should not be dismissed because the site was so small, but rather studied because the site was so small.
“First, credit where it is due. The NCSC and the Department for Energy Security and Net Zero moved quickly, briefing energy CEOs and writing directly to operators with advice and next steps. That is exactly the posture we want from government,” said Riley. “[And] the NCSC’s Cyber Assessment Framework has given operators of essential services a genuinely usable benchmark…. Regulated operators in this country are better protected because of that work.”
However, Riley told Computer Weekly, the incident has highlighted the challenge of protecting sites that sit below these thresholds.
“The UK has around 300 small peaker plants, and a rapidly growing fleet of distributed renewables, batteries and flexibility assets. Individually, each is a rounding error against grid capacity. Collectively, they are becoming the grid. Yet capacity thresholds mean many fall outside formal cyber security regimes, and for a small operator the cost of robust security engineering can feel disproportionate to the asset,” said Riley.
“In an energy system that is deliberately becoming distributed, reliant on thousands of smaller, unmanned, remotely operated generators, secure by design and defence in depth cannot remain conference slideware. They have to be reality at the point of procurement.”
Huntress virtual chief information security officer (vCISO) and cyber security advisor Muhammad Yahya Patel also highlighted the sudden exposure of such a serious visibility gap.
“If smaller energy operators fall outside mandatory cyber-reporting thresholds, we risk underestimating how frequently this part of our infrastructure is being targeted or successfully compromised,” said Patel. “Critical infrastructure security cannot stop with the organisations considered large enough to be critical. Attackers will look for the weakest route in, so resilience, monitoring and rehearsed recovery need to extend across the wider energy ecosystem.”
More questions
Graeme Stewart, Check Point head of public sector, said that the attack marked a “grave escalation” in the ongoing Iran conflict, and the fact the target was relatively insignificant should not mask that.
“The far more serious point is what the attackers appear to have demonstrated: an ability to get inside UK energy infrastructure and stop it working. We have to ask what happens if the next target is bigger,” he said.
“We also need to consider whether causing widespread disruption was ever the objective here. If this attack was intended to demonstrate that Iranian-linked hackers can penetrate UK infrastructure and cause real-world consequences, then the significance isn’t measured by the size of the generator they managed to shut down, but by what they have demonstrated may be possible,” he added. “The question now has to be whether Britain is genuinely ready if something more serious follows.”
And for Patel, the significance of the attack arose less from the size of the target but more from the ensuing disruption. “Why did recovery take four days, and are smaller operators adequately prepared to contain and recover from these incidents?” he said.
“The real measure of cyber resilience is no longer simply whether you can prevent an intrusion. It’s whether you can contain one quickly enough that a cyber incident doesn’t become an operational crisis.”
S 004