The Rising Threat of Third-Party Cybersecurity Breaches in the U.S. Energy Sector

In an era where cyber threats are becoming increasingly sophisticated, the U.S. energy sector finds itself at a critical juncture. A recent joint study by SecurityScorecard and KPMG has revealed alarming statistics: nearly half (45%) of security breaches in this vital sector can be traced back to third-party vendors. This finding underscores a significant vulnerability that could have far-reaching implications for both citizens and businesses alike.

The Scope of the Problem

The study, which analyzed data from the 250 largest energy companies in the U.S., paints a stark picture of the cybersecurity landscape. It indicates that over 90% of companies that experienced multiple breaches were compromised due to third-party risks. This figure is particularly concerning when compared to a global average of 29% for supply chain breaches across all industries. The energy sector is uniquely vulnerable, with 90% of attacks involving third parties, highlighting a systemic issue that demands urgent attention.

Key Contributors to Breaches

Among the various factors contributing to these breaches, the exploitation of the MOVEit file transfer software vulnerability in 2023 emerged as the most significant, accounting for 39% of incidents. This statistic serves as a reminder of how a single vulnerability can have cascading effects across an entire sector, emphasizing the need for robust cybersecurity measures.

The Weakest Link: Third-Party Vendors

The reliance on third-party vendors is a double-edged sword. While these partnerships can enhance operational efficiency and innovation, they also introduce vulnerabilities. The study found that 67% of third-party-related breaches involved external software and IT providers, while 22% were linked to other energy companies. This reliance on external entities means that the security of the energy sector is only as strong as its weakest link.

Ryan Sherstobitoff, Senior Vice President of Threat Research and Intelligence at SecurityScorecard, aptly noted, “The energy sector’s growing dependence on third-party vendors highlights a critical vulnerability.” As the industry continues to evolve, it is imperative that companies take decisive action to fortify their cybersecurity measures before a breach escalates into a national emergency.

Current Cybersecurity Ratings

The report’s findings indicate that the U.S. energy sector scored only a “B” on cybersecurity, with 81% of companies achieving an A or B rating. However, the remaining 19% with weak scores pose a significant risk to the entire supply chain. This disparity highlights the urgent need for a collective defense approach, as vulnerabilities in one company can have ripple effects throughout the sector.

Interestingly, the study revealed that fossil fuel companies scored better than their renewable counterparts, with oil and natural gas firms achieving an “A” rating, while renewable energy companies lagged behind with a “B.” This discrepancy raises questions about the cybersecurity preparedness of emerging energy technologies and the need for increased focus on securing these systems.

Identifying Key Risk Factors

The study identified three primary risk factors contributing to vulnerabilities in the energy sector: application security (40%), network security (23%), and DNS (Domain Name System) health (29%). Alarmingly, 92% of companies had their lowest scores in these areas, indicating a pressing need for targeted improvements.

Emily Phelps, director at threat intelligence provider Cyware, emphasized the importance of collaboration in addressing these risks. “As cyberattacks increasingly exploit supply chain weaknesses, organizations can no longer afford to operate in silos,” she stated. By fostering collaboration between trusted companies and industries, organizations can better identify risks and coordinate defenses.

The Challenge of Aging Infrastructure

Another critical issue facing the U.S. energy sector is the prevalence of aging infrastructure. Willy Leichter, CMO at security provider AppSoc, pointed out that legacy systems contribute to the sector’s vulnerability to supply chain attacks. The slow and deliberate nature of software update processes leaves known vulnerabilities exposed for extended periods, creating opportunities for malicious actors.

To mitigate these risks, energy companies must adopt more agile approaches to software updates, decoupling them from operational infrastructure. This shift would enable quicker responses to vulnerabilities and reduce the window of exposure to potential attacks.

The Path Forward: Proactivity is Key

As the energy sector grapples with these challenges, the need for proactive measures has never been more critical. Phelps stressed that companies relying solely on reactive strategies could leave critical infrastructure exposed to recurring threats. “Only through shared intelligence and coordinated efforts can we address these complex, evolving risks effectively,” she concluded.

In conclusion, the findings from the SecurityScorecard and KPMG study serve as a wake-up call for the U.S. energy sector. With third-party risks driving nearly half of all breaches, it is imperative for companies to strengthen their cybersecurity measures and foster collaboration across the industry. By doing so, they can better protect themselves and the citizens who rely on their services, ensuring a more secure energy future.