Cybersecurity & critical infrastructures : the challenges facing the energy sector

From offshore wind farms to nuclear power plants, hydroelectric facilities, solar farms and oil and gas transmission networks, companies in the energy sector face a strategic imperative: to modernize their systems via digital interconnection, while strengthening their cybersecurity posture.

Against a backdrop of energy transition, combined with the growing importance of smart grids and connected SCADA systems, , the attack surface sector is expanding considerably. Cyber risk, although intangible, now carries as much weight as traditional physical risks, as it can destabilize energy supplies (electricity, oil or natural gas), potentially affecting all a state's essential services, from health to telecommunications to mobility.

At a time when the power grid is the digital backbone of society, the security of its nerve centers is no longer simply a technical necessity: it's a sovereign requirement.

A high-voltage history: cyberthreats in the energy sector

The history of energy cybersecurity is punctuated by major attacks, revealing the sector's systemic vulnerabilities. The Stuxnet worm (2010), designed to infiltrate and sabotage Iranian centrifuges, acted as a global catalyst: for the first time, a cyber attack physically targeted a critical nuclear infrastructure.

In 2016, the attack on the Pivnichna substation in Kiev, via a phishing campaign exploiting a Windows XP flaw, enabled hackers to take control of circuit breakers remotely, depriving part of the city of power for almost an hour. This social engineering operation directly targeted Industrial Control Systems (ICS), underlining the criticality of OT vulnerabilities.

In 2019, Colonial Pipeline - a structuring player in the transportation of hydrocarbons in the USA - was hit by ransomware crippling its logistics operations. The $4.4 million ransom paid to unlock the system marked a turning point in the recognition of cyber risks as direct economic threats.

According to the X-Force Threat Intelligence Index 2022 report, the energy sector is the 4th most attacked target worldwide, accounting for 8.2% of all recorded attacks. Ransomware (25% of cases), Remote Access Trojans (RATs), Distributed Denial of Service (DDoS) attacks and identity theft (BEC) are the main weapons used by attackers.

Strengthening the legal framework for players in the energy sector

Faced with this growing threat, regulators are stepping up initiatives to build a foundation of digital resilience. In France, the Agence Nationale de la Sécurité des Systèmes d'Information (ANSSI - French national agency for information systems security) oversees the security of Operators of Vital Importance (OIV - Opérateurs d'Importance Vitale), including energy companies. Since the 2013 Military Planning Law (LPM), Vital Information Systems (SIIV) have been subject to strict requirements for certification, auditing and continuity plans.

At European level, the NIS (Network and Information System Security) directive introduced in 2016, required essential service operators (ESOs) to proactively manage incidents and coordinate between member states. Here, ENISA (the European Cyber Security Agency) plays a central role in securing energy infrastructures, which have become deeply interconnected and cross-border.

Towards systematic cybersecurity: the arrival of NIS2

The NIS2 directive radically reforms the previous framework, we're moving from a reactive model to a preventive paradigm, by imposing an extended organizational cybersecurity logic: governance, regular audits, traceability, supply chain security, and reporting obligations. We're moving from a reactive model to a preventive paradigm.

Key developments include :

• An obligation to notify major incidents within 24 hours, followed by a technical report within 72 hours.

• Explicit management accountability.

• Introducing cybersecurity into supply chains: service providers, IT suppliers, equipment manufacturers and cloud services now have to prove their security compliance.

The aim is to build a defense-in-depth system that extends from the perimeter layer to indirect partners, avoiding domino effects in the event of a breach at a subcontractor.

Energy infrastructure security: the specific challenges of the IT/OT pair

One of the major obstacles to cyber security in the energy sector lies in the hybrid nature of infrastructures. While IT (Information Technology) systems benefit from mature security mechanisms, industrial environments (OT - Operational Technology) are historically disconnected, poorly updated, and often incompatible with traditional security solutions.

Industrial assets such as turbines, PLCs and SCADA sensors have life cycles of up to 30-40 years. The introduction of digital technology into these environments, via IT/OT convergence, greatly increases exposure to risk.

An effective strategy depends on rigorous mapping of industrial assets, this calls for a continuous assessment of vulnerabilities, as well as close coordination between CISOs, CIOs and industrial operations managers.

Defense in depth and digital hygiene: towards a multi-layer security model

Defending energy networks requires a layered, interdependent approach. This multi-layered cybersecurity architecture aims to delay, contain and then neutralize any attempt at compromise.

Key levers include :

• Software and physical separation of IT and OT environments,

• Segmentation of the OT network, to isolate critical segments,

• Setting up secure bastions for the administration of industrial systems,

• A structured patch management policy,

• Proactive awareness-raising and training of field staff, the first line of defence against the human vector of attack.

Centralized supervision systems, combined with behavioral analysis tools (SIEM, , EDR, nDR), can now detect anomalies in real time on critical operational flows. The ability to react quickly, in coordination with CERT (Computer Emergency Response Teams), becomes crucial.

Conclusion: anticipate rather than suffer, an imperative for a vital sector

As energy infrastructures become increasingly interconnected and digitalized, cybersecurity is becoming an indispensable strategy for dealing with cyberattacks. Cyber attacks are no longer a potential risk, but a real one that can affect the continuity of supply and the very functioning of a state.

The arrival of regulatory frameworks such as NIS2 reflects a growing awareness of this reality: cybersecurity is now a global governance responsibility, involving general management, and can no longer be treated as a mere technical issue.

In this context, anticipating rather than undergoing becomes a strategic imperative. This presupposes a global vision integrating IT/OT convergence, defense in depth adapted to industrial constraints, and a culture of cybersecurity at all levels: from the field to management. Only then will the sector be able to withstand cyber-attacks without compromising its primary mission: guaranteeing reliable, continuous and secure access to energy, the essential foundation of our society's sovereignty and stability.