By Mike Sewart, Chief Technology Officer, Thales UK
For energy operators, one of the hardest questions during a cyber incident is not necessarily how the attacker got in, but what can safely be switched off next.
That question becomes much harder when electricity networks depend on a growing mix of operational technology, corporate IT, cloud services, remote access, third-party suppliers and increasingly intelligent assets at the edge of the grid. The energy transition is adding more digital capability for good reason: operators need greater visibility, automation and flexibility to manage a system with more renewable generation, storage, electric vehicles and changing patterns of demand.
The challenge is that every new connection can introduce another dependency. As IT, operational technology and wider digital infrastructure become more interlinked, resilience increasingly depends on whether operators understand how those systems interact when something goes wrong.
More security does not always mean more clarity
Thales’ latest critical infrastructure research found that 76% of organisations within the sector are using five or more data protection tools, yet only 40% are confident in their understanding of those tools.
For energy operators, this is more than an IT management issue. Most critical infrastructure has evolved over many years, with new digital platforms added alongside legacy operational systems, specialist and bespoke equipment and cloud services increasingly sitting next to technologies that were originally designed to operate in much more isolated environments.
Additional controls may improve protection in individual areas, but they can also add to the complexity that teams are expected to manage. It all places pressure on an organisation’s ability to understand the environment around it well enough to act confidently when disruption occurs.
Credential compromise illustrates the point. Thales’ research also found that 66% of critical infrastructure organisations were seeing credential theft and misappropriated secrets increase. Where an attacker can use legitimate access, activity may initially resemble that of an authorised user or system, making it essential to understand what individual identities can reach, how that access is monitored and managed over time, and whether access to one environment could provide a route into another.
That is why fundamentals such as segmentation remain so important. A compromise in corporate IT should not automatically provide a pathway into operational systems controlling physical infrastructure.
Mapping consequences, not just assets
The urgency around this will only increase as the UK works towards its 2030 clean power ambitions. Great Britain is expected to need around twice as much new transmission infrastructure by 2030 as was built over the previous decade, and this wider system will also have to coordinate more distributed generation, storage and flexible demand. That creates more assets to manage, and equally, more relationships between them.
Most organisations already maintain some form of asset inventory, but the next level is understanding how they link together and the possible consequences – if one application becomes unavailable, which processes stop working? If a communications service is isolated, what visibility is lost? If a supplier connection must be disabled, does another critical system depend on it?
Those questions matter because as more technologies such as batteries, demand-side response, smart charging and distributed generation are involved with the grid, they can give operators valuable new ways to balance the system, but they also rely on data, software and communications being available when needed.
The work of cyber resilience therefore must incorporate dependency mapping. It is not enough to know what assets exist; operators also need to understand how disruption in one part of the system could affect the others around it.
Recovery is an operational discipline
No energy operator can assume that every cyberattack will be prevented, which is why recent NCSC guidance places greater emphasis on preparing organisations to withstand and recover from disruptive incidents, including the loss of critical IT and OT systems.
That preparation needs to go beyond documentation. At Thales’ Cyber Resilience Lab in Ebbw Vale, representative industrial systems can be used to explore cyber scenarios without creating risk to live infrastructure. Environments like this allow engineers and cyber teams to examine how systems respond to isolation, configuration changes and recovery actions, while also providing an environment to train the teams involved in coordinating and making those decisions.
That matters because a cyber incident can quickly become an operational one. Engineers, security teams, suppliers and senior leaders may all need to act at the same time, and rehearsing that response can expose unclear responsibilities or hidden dependencies before they emerge during a real event.
The smarter grid will inevitably contain more technology, software and connectivity – but key to making sure it remains stable and secure is that operators can still see through it.
When disruption does occur, resilience will depend less on how many tools are on the dashboard than on whether people understand what they are looking at, how the different parts of the system depend on one another and what they need to do next.
