Hundreds of Britain’s smallest power plants could remain at a higher risk to state-sponsored cyber-attacks until the 2030s despite a successful Iran-linked hack last month, it has emerged. Officials this week briefed energy bosses on the breach, which is understood to have shut an unnamed small gas power plant for four days last month, and put the industry on alert over the growing cyber threat facing energy infrastructure. However, the government’s own plan to toughen the baseline cybersecurity standards for Britain’s smallest power generators will not be required until the end of 2030, raising concerns over “an unacceptable gamble with our national security”.
Official government documents, published this month, call for the industry regulator, Ofgem, to lay out proposals for new baseline cyber resilience requirements for gas and electricity infrastructure by the end of 2027, ahead of implementing new standards by the end of 2030. The Guardian understands that the hack has not altered this timeline. The new requirements would cover the type of small-scale gas plant which is understood to have been successfully attacked by the Iran-linked hackers in the weeks before the government set out its timeline for bolstering the sector’s cybersecurity standards.
Reports of the unprecedented cyber hack emerged as the Cabinet Office prepares to urge UK citizens to stock up on tinned food and bottled water to prepare for extreme weather events and potential attacks from hostile states. Calum Miller, the Lib Dems’ foreign affairs spokesperson, said: “Leaving hundreds of small power generators exposed to cyber threats until the 2030s is simply an unacceptable gamble with our national security.” Britain has hundreds of small-scale, unmanned gas plants connected to local power grids which are typically idle for most of the year but can be used to ramp up generation when electricity supplies are squeezed. Although the outage had no impact on the electricity system, the attack has raised concerns about vulnerabilities in locally connected power infrastructure which is not required to meet the same security standards as large-scale power plants and transmission assets.
We mustn’t leave an open goal to hostile states at a time of heightened global threats.” The government opened a consultation into the cyber resilience of power generators in March, after it introduced the cyber security and resilience bill to parliament late last year, with a warning that the UK now faces four nationally significant cyber-attacks every week. Michael Shanks, the energy minister, said in the consultation that the UK “needs to keep pace with the current threat landscape”. An industry source familiar with the post-attack industry briefing confirmed reports, which first appeared in the Sunday Telegraph, that the plant was shut down for about four days in one the most successful cyber-attacks on UK energy infrastructure.
This particular incident may not have had consequences for the wider grid, but the next one could be different.” “What concerns me about this incident is not necessarily the size of the power generator that was affected, but how many others may be out there,” Narezzi added. They look for vulnerabilities, trusted access and opportunities. Individually, many may appear insignificant.
Collectively, their resilience matters enormously.” A government spokesperson said: “The UK has a highly resilient energy system. We work closely with the energy sector to protect infrastructure and ensure the highest security standards.
Extract — continue reading at the source.
