Targeting the Energy Sector

Protective Measures

• Security By Design: When developing smart infrastructure, organizations should design it not just with security to prevent intrusions, but to minimize damage in the event of a compromise. For example, should certain critical software be custom-designed to prevent easy analysis by hackers? Can physical, manual, and programmatic fail safes be included to prevent malicious events?

• Enhanced Training: Companies should also strongly consider training board members and staff, including employees in non-technical departments, and those trainings should be tailored to employees' responsibilities. For instance, board training should focus on the importance of investing in cybersecurity and keeping the board appraised of liability risks posed by cyber threats. Likewise, non-technical employees should receive training on how to detect cyber threats, recognize common attack tactics like phishing emails, and most importantly what to do in the event of a suspected attack.

• Cyber Insurance: Also a consideration for organizations is whether their insurance policies cover this type of harm. Cyber insurance typically contemplates coverage for unauthorized disclosure of personal or confidential data and does not necessarily factor in damage to persons or real property. Therefore, infrastructure and energy companies should confirm whether they are covered should they experience this type of attack

Conclusion

Anna Rudawski and Alexis Wilpon are associates, and David Kessler is head of the U.S. Privacy, Data Protection and Cyber Security Group, at Norton Rose Fulbright.