One Step Ahead

Electricity Canada: The Grid 2022

Many of the articles in this magazine explain that Canada must accelerate investments, technologies, and regulatory improvements to enable the electricity sector to meet clean energy goals and economy-wide net zero targets. Our predominantly and proudly clean electricity system is essential to grow a clean energy and inclusive economy, and to help other sectors decarbonize.

In this conversation, policy makers, thought leaders and regulators must not forget about the importance of security. Threats to Canada’s critical infrastructure, including electricity, have begun to accelerate as well. Threat actors are becoming smarter and more numerous. And while new technologies and a more connected world offer a wealth of opportunities to make life better for everyone, they offer new risks that security professionals must manage.

But, don’t just take my word for it. Canada’s National Cyber Threat Assessment identifies a growing threat to critical infrastructure, including electricity, from state and non-state actors. We’ve seen recent, highly public examples of this, including the Log4j vulnerability, risks from global conflicts, and the Colonial Pipeline attack. Risks will only grow as more distributed assets are added to the grid and as threat actors become more sophisticated.

Indeed, the Canadian Centre for Cyber Security assesses that operational technology (OT) digital transformations are “almost certainly providing cyber threat actors with new opportunities to access and disrupt OT systems”, and that cybercriminals are improving their skills. The North American Electric Reliability Corporation’s (NERC) 2021 ERO Reliability Risk Priorities Report explains that the “potential for increasing cyber attacks across all sectors has increased…for example, the 2020 SolarWinds and 2021 Colonial pipeline attacks accentuate supply chain vulnerabilities as well as threats from both foreign actors and domestic adversaries.” Technological advancements such as AI, offer new tools for cyber threat actors to use.

Electricity Canada: The Grid 2022

Meanwhile, physical threats to the grid continue – from copper theft, to pandemics, to more frequent extreme weather events.

Canada’s electricity companies work 24/7 to ensure reliable and secure power for homes and businesses, preparing for, and ready to respond to, a wide variety of threats.

Given the diversity and types of threats, the electricity sector’s security toolbox is quite large and contains:

• Exercises like GridEx, which brings together the electricity security community from Canada and the U.S. to practice response and recovery in the face of simulated, coordinated cyber and physical attacks on the North American electricity system, and other critical infrastructure • Mandatory reliability and security standards from NERC as a baseline • Threat intelligence sharing and mutual assistance programs • Investments in the tools, technology, people, resources and processes to improve security postures, and • Forums for security professionals across the sector to exchange information and work together to manage and address risks.

As communities look to more clean electricity to help solve climate change challenges and to power more of the economy, the imperative for reliable and resilient electricity will only expand. Electricity companies are prepared to do their part in ensuring customers can depend on reliable and sustainable electricity – they already are. But no one company or sector or government authority can do this alone - critical infrastructure security is a shared responsibility. As threats speed up, deeper trusted partnerships in the critical infrastructure security community will be essential. Government and regulators have an essential role to play here too – to accelerate investment in programs and activities that improve the security posture of Canadian critical infrastructure.

This means:

• Promoting and training a security workforce • Deepening support for intelligence sharing and incident response programs between industry and government • Ensuring that electricity companies can continue to invest in security • Continuing investments in research, development and deployment of new technologies, programs or practices that make the grid more secure. • Working with allies to create robust, secure, and resilient supply chains, and • Continuing a commitment to participating in forums such as GridEx

Threats against the electricity sector are not slowing down, and we can’t always predict what will come next. With a continued commitment from the electricity security community to ensure safe and reliable electricity to customers, and always asking what is next, we can work together to keep one step ahead.