Introduction
The electric utility industry is at a critical point in the area of cybersecurity. As the backbone of modern society, electrical grids and their associated infrastructure have become prime targets for malicious actors ranging from nation-states to sophisticated criminal organizations. The increasing digitization and interconnectedness of utility systems, while bringing unprecedented efficiencies, have also opened new avenues for cyber attacks.
This comprehensive analysis delves into the evolving landscape of cybersecurity threats facing electric utilities, examining historical trends, current capabilities of threat actors, potential worst-case scenarios, and strategies for robust preparedness extending into the coming decades. As we navigate this complex terrain, it becomes clear that the stakes have never been higher, and the need for innovative, adaptive security measures has never been more pressing.
Did you know? The global cybersecurity market size for the energy sector is expected to grow from $16.1 billion in 2020 to $26.7 billion by 2025, at a Compound Annual Growth Rate (CAGR) of 10.6% during the forecast period.1
As we delve deeper into this critical issue, we’ll explore how recent developments such as the proliferation of zero-day attacks and the surge in ransomware incidents are reshaping the threat landscape for electric utilities. We’ll also examine how the industry is responding to these challenges and what measures are being taken to safeguard our critical infrastructure against an increasingly sophisticated array of cyber threats.
Historical Trends in Utility Cybersecurity
The trajectory of cybersecurity threats against electric utilities has seen a marked escalation over the past two decades. Early incidents were often exploratory in nature, with actors probing for vulnerabilities rather than executing large-scale attacks. However, as digital transformation accelerated across the industry, so too did the sophistication and frequency of cyber threats.
Key Milestones:
While not a real attack, this U.S. government exercise demonstrated the potential vulnerabilities in critical infrastructure, including power grids, to cyber attacks. It served as an early wake-up call for the industry.2
Although not caused by a cyber attack, this incident highlighted the cascading effects of grid failures and spurred increased focus on critical infrastructure protection. The blackout affected an estimated 55 million people in the northeastern United States and Ontario, Canada.3
This controlled experiment by Idaho National Laboratory demonstrated how a cyber attack could cause physical damage to a generator, raising alarms about the potential for cyber-physical attacks on the power grid.4
Though targeting nuclear facilities, this worm demonstrated the potential for cyber-physical attacks on industrial control systems used in many utilities. Stuxnet was unprecedented in its complexity and its ability to cause physical damage through a cyber attack.5
The first confirmed cyber attack to result in a power outage, affecting approximately 225,000 customers. This attack demonstrated the real-world impact of cyber operations on critical infrastructure.6
While not specifically targeting utilities, this global ransomware attack affected numerous industries and demonstrated the potential for rapid, widespread disruption. The attack caused an estimated $10 billion in damages worldwide.7
Though affecting an oil pipeline rather than electric utilities, this incident showcased the vulnerability of critical infrastructure to ransomware and its potential to cause widespread disruption. The attack led to fuel shortages across the southeastern United States.8
Evolution of Cybersecurity Regulations
As the threat landscape evolved, so did the regulatory environment surrounding utility cybersecurity:
- 2005: The North American Electric Reliability Corporation (NERC) was designated as the Electric Reliability Organization for the United States by the Federal Energy Regulatory Commission (FERC).
- 2008: NERC’s Critical Infrastructure Protection (CIP) standards became mandatory and enforceable in the U.S.
- 2013: Executive Order 13636 was issued, calling for improved cybersecurity information sharing between the government and critical infrastructure owners and operators.
- 2015: The Fixing America’s Surface Transportation (FAST) Act granted the Department of Energy new authority to address grid security emergencies.
- 2020: Executive Order 13920 was issued, focusing on securing the U.S. bulk-power system supply chain.
These regulatory developments reflect the growing recognition of cybersecurity as a critical concern
These regulatory developments reflect the growing recognition of cybersecurity as a critical concern for electric utilities and the broader energy sector. As threats have evolved, so too has the approach to regulation, moving from voluntary guidelines to mandatory standards with significant penalties for non-compliance.
Current Threat Landscape
Today’s cyber threats to electric utilities are characterized by their diversity, sophistication, and potential for widespread impact. The convergence of information technology (IT) and operational technology (OT) in modern utility systems has expanded the attack surface, creating new vulnerabilities and challenges for cybersecurity professionals. Let’s explore the most pressing threats in detail:
Nation-state actors and well-funded groups are increasingly targeting critical infrastructure. These APTs often employ long-term strategies, leveraging zero-day vulnerabilities and social engineering to maintain persistent access to utility networks.
Key Fact: A 2021 report by FireEye identified multiple APT groups specifically targeting the energy sector, with some campaigns lasting over 18 months before detection.9
APTs pose a significant threat due to their patience, resources, and sophisticated techniques. They may lie dormant in a system for months or even years, gathering intelligence and waiting for the opportune moment to strike. The motivations behind these attacks can range from espionage to preparation for future conflicts.
| APT Group | Suspected Origin | Known Targets |
|---|---|---|
| Dragonfly | Russia | Energy sector in North America and Europe |
| APT41 | China | Utilities, telecommunications, and high-tech industries |
| Lazarus Group | North Korea | Critical infrastructure and financial institutions |
The persistent nature of these threats requires utilities to adopt a “assume breach” mentality, implementing robust detection and response capabilities alongside traditional prevention measures.
The ransomware threat to electric utilities has escalated dramatically in recent years, with several high-profile incidents causing significant disruptions:
- CS Energy Attack (2021): Australian electric utility CS Energy was hit by a ransomware attack that threatened to disrupt power supply to millions of homes. While major outages were avoided, the incident highlighted the potential for ransomware to impact critical infrastructure.10
- Colonial Pipeline Incident (2021): Although not an electric utility, this attack on a major fuel pipeline demonstrated the cascading effects of ransomware on critical infrastructure. The incident led to fuel shortages across the southeastern United States and prompted a reevaluation of cybersecurity measures in the energy sector.11
- Elektro Eletricidade e Serviços Attack (2020): This Brazilian power utility was hit by ransomware, affecting systems and customer service for several days.12
These incidents underscore the evolving nature of ransomware threats, with attackers increasingly targeting critical infrastructure to maximize leverage and potential payouts.
Emerging Trend: Double Extortion
A concerning development in ransomware attacks is the rise of “double extortion” tactics. In these scenarios, attackers not only encrypt data but also exfiltrate sensitive information, threatening to release it publicly if ransom demands are not met. This approach puts additional pressure on utilities to pay, as they face both operational disruptions and potential data breaches.13
The ransomware-as-a-service (RaaS) model has lowered the barrier to entry for cybercriminals, leading to a proliferation of attacks. Utilities must not only focus on preventing these attacks but also on developing robust incident response and business continuity plans to mitigate their impact.
Supply chain attacks have emerged as a significant threat to electric utilities, exploiting the trust relationships between organizations and their vendors or software providers. These attacks can have far-reaching consequences, potentially compromising multiple utilities simultaneously.
Notable supply chain incidents affecting the energy sector include:
- SolarWinds Attack (2020): This sophisticated supply chain attack affected numerous organizations globally, including several in the energy sector. The attackers compromised the software build process of SolarWinds’ Orion platform, inserting malicious code into legitimate software updates.14
- Havex Malware Campaign (2014): This campaign targeted industrial control systems (ICS) vendors, compromising their websites to distribute malware to energy sector customers.15
Best Practices for Supply Chain Security
- Implement rigorous vendor risk assessment processes
- Require vendors to adhere to specific security standards
- Conduct regular security audits of critical suppliers
- Implement network segmentation to limit the potential impact of compromised vendor systems
- Utilize software composition analysis tools to identify and track third-party components
The complexity of modern utility supply chains, combined with the increasing reliance on third-party software and services, makes this threat particularly challenging to address. Utilities must adopt a holistic approach to supply chain security, considering both cyber and physical risks throughout the lifecycle of their relationships with vendors and service providers.
Zero-day vulnerabilities pose a significant threat to electric utilities due to their unpredictable nature and the potential for widespread impact before patches can be developed and deployed. These previously unknown vulnerabilities can be exploited to gain unauthorized access, disrupt operations, or exfiltrate sensitive data.
Alarming Trend: According to a report by Mandiant, the number of zero-day vulnerabilities exploited in the wild increased by over 100% from 2020 to 2021, with critical infrastructure sectors being frequent targets.16
Recent zero-day exploits that have impacted or could potentially affect electric utilities include:
- PrintNightmare (2021): This vulnerability in the Windows Print Spooler service affected a wide range of systems, including those used in utility networks for printing and document management.17
- Ripple20 (2020): A set of 19 vulnerabilities in a widely-used TCP/IP software library, potentially affecting millions of IoT devices and industrial control systems used in the energy sector.18
- BlueKeep (2019): A critical vulnerability in Microsoft’s Remote Desktop Protocol (RDP) that could allow for wormable attacks, posing a significant risk to utility networks using RDP for remote management.19
Mitigating Zero-Day Risks
- Implement robust vulnerability management programs
- Utilize virtual patching and intrusion prevention systems
- Employ application whitelisting and least privilege principles
- Conduct regular penetration testing and red team exercises
- Participate in threat intelligence sharing programs
While it’s impossible to completely eliminate the risk of zero-day exploits, utilities can significantly reduce their exposure by adopting a defense-in-depth approach and maintaining a strong security posture across their entire infrastructure.
Insider threats remain a persistent concern for electric utilities, with the potential for significant damage due to employees’ or contractors’ privileged access to critical systems. These threats can be both intentional (e.g., disgruntled employees) or unintentional (e.g., through negligence or social engineering).
Key Fact: The U.S. Department of Energy reported that insider threats were responsible for 29% of cybersecurity incidents in the energy sector in 2019.20
Notable insider threat incidents in the utility sector include:
- Ukrainian Power Grid Attack (2015): While primarily an external attack, the initial compromise was facilitated by stolen user credentials, highlighting the importance of robust access controls and monitoring.21
- Limerick Generating Station Incident (2016): A contract engineer at this nuclear power plant was charged with attempting to steal confidential information and transfer it to a foreign government.22
Insider Threat Mitigation Strategies
- Implement robust identity and access management (IAM) systems
- Conduct regular security awareness training for all employees
- Deploy user and entity behavior analytics (UEBA) solutions
- Establish clear policies and procedures for handling sensitive information
- Implement strict controls on third-party access to critical systems
Addressing insider threats requires a combination of technical controls, policy measures, and cultural changes within organizations. Utilities must foster a culture of security awareness while also implementing robust monitoring and access control systems to detect and prevent malicious or accidental insider actions.
The proliferation of Internet of Things (IoT) devices in smart grid implementations has significantly expanded the attack surface for electric utilities. While these devices offer improved efficiency and data collection capabilities, they also introduce new vulnerabilities if not properly secured.
Concerning Trend: A 2021 Ponemon Institute study found that 64% of utilities had experienced an attack involving IoT devices in the past two years.23
Key IoT-related vulnerabilities in the utility sector include:
- Smart Meter Exploitation: Researchers have demonstrated vulnerabilities in smart meters that could allow attackers to manipulate energy consumption data or even cause physical damage.24
- SCADA System Vulnerabilities: Many Industrial IoT devices used in SCADA systems have been found to have weak authentication mechanisms or unpatched vulnerabilities.25
- Botnet Recruitment: Unsecured IoT devices can be recruited into botnets, potentially being used to launch DDoS attacks against utility infrastructure.26
Case Study: BlackEnergy Malware
The BlackEnergy malware, used in the 2015 Ukrainian power grid attack, specifically targeted industrial control systems and SCADA devices. This incident highlighted the potential for IoT vulnerabilities to be exploited in attacks on critical infrastructure.27
To address IoT vulnerabilities, utilities should focus on:
- Implementing strong device authentication and encryption
- Regularly updating and patching IoT devices
- Segmenting IoT devices from critical network infrastructure
- Conducting thorough security assessments before deploying new IoT technologies
- Developing incident response plans specific to IoT-related incidents
As the adoption of IoT devices in utility networks continues to grow, addressing these vulnerabilities will be crucial to maintaining the security and reliability of the power grid.
Emerging Capabilities of Threat Actors
As technology evolves, so do the capabilities of cyber threat actors targeting electric utilities. Understanding these emerging capabilities is crucial for developing effective defense strategies:
1. AI-Powered Attacks
Artificial intelligence and machine learning are being increasingly leveraged by attackers to enhance various aspects of their operations:
- Automated Vulnerability Discovery: AI algorithms can scan networks and applications at scale, identifying potential vulnerabilities faster than human analysts.
- Advanced Social Engineering: AI-generated phishing emails and deepfake technology can create more convincing and targeted social engineering attacks.
- Adaptive Malware: AI-powered malware can dynamically adjust its behavior to evade detection and maximize its impact.
Future Trend: By 2025, it’s estimated that 30% of nation-state and large-scale criminal attacks will leverage AI-powered technologies in some form.28
2. Quantum Computing Threats
While still in its early stages, the development of quantum computing poses a long-term threat to current cryptographic standards used to secure utility communications and data:
- Cryptography Breaking: Quantum computers could potentially break widely-used encryption algorithms, compromising secure communications and data storage.
- Rapid Problem Solving: Quantum computing could enable attackers to solve complex problems much faster, potentially accelerating the discovery of vulnerabilities or the cracking of passwords.
Utilities must begin preparing for the post-quantum era by exploring quantum-resistant cryptographic algorithms and considering the long-term security of their data.
3. 5G and Advanced Wireless Attacks
The rollout of 5G networks and other advanced wireless technologies introduces new attack vectors and challenges for electric utilities:
- Expanded Attack Surface: 5G enables more devices to connect to the network, potentially increasing the number of entry points for attackers.
- Network Slicing Vulnerabilities: The network slicing feature of 5G, while offering improved efficiency, could be exploited to bypass security controls if not properly configured.
- Low-Latency Attacks: The low latency of 5G could enable faster and more sophisticated attacks, making detection and response more challenging.
As utilities adopt 5G technology for grid modernization efforts, they must carefully consider the security implications and implement appropriate safeguards.
4. Advanced Persistent Infrastructure Threats (APITs)
APITs represent a evolution of traditional APTs, specifically targeting critical infrastructure with a focus on long-term persistence and potential physical impact:
- Firmware-Level Persistence: Attackers are developing sophisticated techniques to implant malware at the firmware level, making it extremely difficult to detect and remove.
- Cross-Domain Attacks: APITs may leverage vulnerabilities across IT, OT, and IoT systems to gain comprehensive control over utility infrastructure.
- Physical Impact Capabilities: These threats are increasingly designed with the potential to cause physical damage to equipment or disrupt operations on a large scale.
Emerging Concern: Security researchers predict that by 2025, at least one major critical infrastructure attack will involve an APIT component designed to cause physical damage.29
Potential Worst-Case Scenarios
While the probability of extreme scenarios may be low, understanding potential worst-case outcomes is crucial for comprehensive risk assessment and preparedness. Here are some scenarios that electric utilities must consider:
1. Coordinated Multi-Grid Attack
A synchronized cyber attack on multiple regional grids could lead to widespread, long-duration blackouts affecting millions of customers. Such an attack could potentially:
- Overwhelm mutual assistance capabilities
- Cause cascading failures across interconnected systems
- Result in significant economic losses and potential loss of life
A 2015 analysis by Lloyd’s of London and the University of Cambridge estimated that a major cyber attack on the U.S. power grid could cost the economy up to $1 trillion in various economic impacts.30
2. Prolonged Data Integrity Attack
A sophisticated, long-term campaign to subtly manipulate grid operational data could lead to:
- Gradual degradation of grid stability
- Misallocation of resources and inefficient operations
- Loss of public confidence in utility operations
Such attacks could remain undetected for extended periods, compounding their impact over time.
3. Supply Chain Compromise of Critical Components
A large-scale compromise of the supply chain for critical grid components could:
- Insert vulnerabilities or backdoors into a wide range of utility systems
- Enable coordinated, widespread attacks across multiple utilities
- Undermine trust in essential technology providers
4. AI-Orchestrated Adaptive Attack
As AI capabilities advance, we may see attacks that can:
- Dynamically adapt to defensive measures in real-time
- Simultaneously target multiple systems and exploit complex interdependencies
- Learn and evolve during the course of an attack, potentially overwhelming traditional defense mechanisms
5. Quantum-Enabled Cryptographic Breakdown
While still a future concern, the advent of practical quantum computing could lead to:
- Sudden invalidation of current cryptographic protections
- Exposure of long-term sensitive data that was previously considered secure
- A race to implement quantum-resistant systems across the entire utility infrastructure
These scenarios, while extreme, underscore the need for robust, adaptive cybersecurity strategies that can evolve to meet emerging threats.
Preparedness Strategies for 2030 and Beyond
To address both current and emerging threats, electric utilities must adopt a forward-thinking, comprehensive approach to cybersecurity. Key strategies include:
1. Adopt a Zero Trust Architecture
Implementing a zero trust model across all utility systems, assuming no user or device is inherently trustworthy. This approach includes:
- Continuous authentication and authorization
- Micro-segmentation of networks
- Least privilege access controls
Industry Trend: Gartner predicts that by 2025, 60% of organizations will embrace zero trust as a starting point for security.31
2. Leverage AI for Cyber Defense
Utilities should harness the power of artificial intelligence and machine learning for:
- Real-time threat detection and response
- Predictive analytics to anticipate potential vulnerabilities
- Automation of routine security tasks
3. Implement Quantum-Safe Cryptography
Preparing for the post-quantum era by:
- Identifying and prioritizing systems that will need quantum-resistant encryption
- Developing a transition plan to quantum-safe algorithms
- Participating in standardization efforts for post-quantum cryptography
4. Enhance Cyber-Physical System Resilience
Design grid systems with the ability to maintain critical functions even when under attack, including:
- Implementing fail-safe modes for critical infrastructure
- Developing autonomous recovery capabilities
- Creating redundant, decentralized control systems
5. Foster Collaborative Threat Intelligence
Enhance information sharing between utilities, government agencies, and cybersecurity firms through:
- Participation in sector-specific Information Sharing and Analysis Centers (ISACs)
- Development of automated threat intelligence sharing platforms
- Regular joint cybersecurity exercises and simulations
6. Invest in Workforce Development
Address the cybersecurity skills gap through:
- Comprehensive training programs for existing staff
- Partnerships with educational institutions to develop tailored curricula
- Creation of apprenticeship and mentorship programs
7. Embrace Security by Design
Integrate cybersecurity considerations throughout the lifecycle of all systems and projects:
- Implement secure development practices for all software and firmware
- Conduct regular security assessments and penetration testing
- Establish a vulnerability disclosure program to engage with security researchers
By implementing these strategies, electric utilities can build a robust, adaptive cybersecurity posture capable of addressing the evolving threat landscape well into the future.
Looking Ahead: 2030-2050
As we look further into the future, several trends and technologies are likely to shape the cybersecurity landscape for electric utilities:
1. Quantum Grid Security
By 2030, quantum technologies may play a significant role in grid security:
- Quantum key distribution for ultra-secure communications
- Quantum sensors for enhanced grid monitoring and anomaly detection
- Post-quantum cryptography fully implemented across critical systems
2. AI-Driven Autonomous Grid Defense
Advanced AI systems could become the primary line of defense for utility networks:
- Self-healing networks that can automatically detect, isolate, and mitigate threats
- AI-powered predictive maintenance to prevent security vulnerabilities
- Autonomous cyber-physical systems capable of operating securely even in compromised environments
3. Decentralized Energy Systems and Blockchain
The growth of distributed energy resources could lead to:
- Blockchain-based smart contracts for secure, decentralized energy trading
- New security challenges related to managing a highly distributed grid
- Increased resilience through decentralization, but also a potentially larger attack surface
4. Biometric and Behavioral Authentication
Advanced authentication methods may become standard:
- Multi-factor biometric authentication for all critical systems access
- Continuous behavioral analysis to detect insider threats
- Integration of neurological signals for ultra-secure authentication
5. Space-Based Energy Systems
As space-based solar power and other extraterrestrial energy technologies become viable, they will introduce new cybersecurity challenges:
- Securing satellite-to-ground communications for power transmission
- Protecting against potential weaponization of space-based energy systems
- Developing international frameworks for space-based critical infrastructure protection
While these future scenarios may seem like science fiction today, the rapid pace of technological advancement means that utilities must start considering their long-term implications now. Developing flexible, adaptable security frameworks will be key to addressing these future challenges.
Conclusion
The cybersecurity landscape for electric utilities is evolving at an unprecedented pace, driven by rapid technological advancements and an ever-expanding threat landscape. As we move towards 2030 and beyond, the potential impact of cyber attacks on critical infrastructure will only increase, necessitating a proactive, adaptive, and collaborative approach to cybersecurity.
Utilities must invest in cutting-edge technologies, foster partnerships across sectors, and cultivate a culture of continuous learning and adaptation. Regulatory frameworks must evolve to keep pace with emerging threats while allowing for innovation. Most importantly, the industry must embrace a long-term perspective, preparing not just for the threats of today, but for the unknowns of tomorrow.
By taking these steps, electric utilities can work towards ensuring the reliability, resilience, and security of our power systems in the face of an increasingly complex and dangerous digital world. The challenges are formidable, but with foresight, collaboration, and unwavering commitment, the industry can rise to meet them.
As we conclude this comprehensive exploration of cybersecurity threats and preparedness for electric utilities, it’s clear that the journey towards a secure and resilient grid is ongoing. The strategies and technologies discussed here provide a roadmap, but success will ultimately depend on the collective efforts of utilities, regulators, technology providers, and cybersecurity professionals working together to stay ahead of evolving threats.
The future of our energy infrastructure—and by extension, our modern way of life—depends on our ability to secure it against cyber threats. Let this analysis serve as a call to action for all stakeholders to redouble their efforts in this critical mission.
References
- MarketsandMarkets. (2020). Cybersecurity in Energy Market – Global Forecast to 2025.
- U.S. General Accounting Office. (1999). Information Security: The Melissa Computer Virus Demonstrates Urgent Need for Stronger Protection Over Systems and Sensitive Data.
- U.S.-Canada Power System Outage Task Force. (2004). Final Report on the August 14, 2003 Blackout in the United States and Canada: Causes and Recommendations.
- Meserve, J. (2007). Mouse click could plunge city into darkness, experts say. CNN.
- Langner, R. (2011). Stuxnet: Dissecting a Cyberwarfare Weapon. IEEE Security & Privacy, 9(3), 49-51.
- Lee, R. M., Assante, M. J., & Conway, T. (2016). Analysis of the cyber attack on the Ukrainian power grid. SANS Industrial Control Systems.
- Greenberg, A. (2018). The Untold Story of NotPetya, the Most Devastating Cyberattack in History. Wired.
- Temple-Raston, D. (2021). A ‘Worst Nightmare’ Cyberattack: The Untold Story Of The SolarWinds Hack. NPR.
- FireEye. (2021). M-Trends 2021 Report.
- Tidy, J. (2021). Cyber-attack on CS Energy: Chinese hackers could have shut off power for three million homes. ABC News.
- Turton, W., & Mehrotra, K. (2021). Hackers Breached Colonial Pipeline Using Compromised Password. Bloomberg.
- Cimpanu, C. (2020). Ransomware attack on Brazilian electric utility. ZDNet.
- Ghafur, S., Kristensen, S., Honeyford, K., Martin, G., Darzi, A., & Aylin, P. (2019). A retrospective impact analysis of the WannaCry cyberattack on the NHS. NPJ Digital Medicine, 2(1), 1-7.
- Neuhaus, C. (2021). The SolarWinds Hack Can Directly Affect Control Systems. SANS Institute.
- ICS-CERT. (2014). Alert (ICS-ALERT-14-176-02A) ICS Focused Malware (Update A).
- FireEye. (2021). Zero-Day Exploitation Quadrupled in 2021. Mandiant.
- Microsoft Security Response Center. (2021). Windows Print Spooler Remote Code Execution Vulnerability.
- JSOF. (2020). Ripple20: 19 Zero-Day Vulnerabilities Amplified by the Supply Chain.
- National Security Agency. (2019). NSA Cybersecurity Advisory: Patch Remote Desktop Services on Legacy Versions of Windows.
- U.S. Department of Energy. (2020). Annual Cybersecurity Report.
- Zetter, K. (2016). Inside the Cunning, Unprecedented Hack of Ukraine’s Power Grid. Wired.
- U.S. Department of Justice. (2016). Former Employee at U.S. Nuclear Site Indicted on Charges of Attempted Energy-Industry Espionage.
- Ponemon Institute. (2021). The State of Industrial Cybersecurity.
- Carpenter, M., & Souppaya, M. (2013). Guide to Industrial Control Systems (ICS) Security. NIST Special Publication 800-82.
- Dragos. (2020). ICS Vulnerabilities: 2020 in Review.
- Mirian, A., Ma, Z., Adrian, D., Tischer, M., Chuenchujit, T., Yardley, T., … & Halderman, J. A. (2016). An Internet-wide view of ICS devices. 2016 14th Annual Conference on Privacy, Security and Trust (PST).
- Lee, R. M., Assante, M. J., & Conway, T. (2016). Analysis of the cyber attack on the Ukrainian power grid. SANS Industrial Control Systems.
- Gartner. (2021). Gartner Predicts By 2025 Cyber Attackers Will Have Weaponized Operational Technology Environments to Successfully Harm or Kill Humans.
- Cambridge Centre for Risk Studies. (2015). Business Blackout: The insurance implications of a cyber attack on the US power grid.
- Gartner. (2021). Gartner Identifies Top Security and Risk Management Trends for 2021.
- U.S. Department of Energy. (2021). Artificial Intelligence and Technology Office Strategic Plan.
- National Institute of Standards and Technology. (2022). Post-Quantum Cryptography Standardization.
- Cyber Resilient Energy Delivery Consortium. (2022). Annual Report.
- Electricity Information Sharing and Analysis Center. (2022). Annual Report.
- National Initiative for Cybersecurity Education. (2021). NICE Framework.
- North American Electric Reliability Corporation. (2023). Critical Infrastructure Protection Standards.
- National Institute of Standards and Technology. (2022). Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations.
- IBM Research. (2021). Brain-Inspired Computing.
- Defense Advanced Research Projects Agency. (2023). Biological Technologies Office.
- National Aeronautics and Space Administration. (2022). Space-Based Solar Power: A NASA Research Project.
- National Renewable Energy Laboratory. (2021). Autonomous Energy Grids.
- U.S. Department of Energy. (2020). U.S. Department of Energy Unveils Blueprint for the Quantum Internet at ‘Launch to the Future: Quantum Internet’ Event.
