Robust cybersecurity is an enabler of net zero

As the race to net zero intensifies, energy service providers are developing and delivering innovative new services at pace to maintain momentum. This move to digital platforms and cloud services has been rapid and PA Consulting cyber risk expert Mark Olliver argues it is paramount that they include ‘security by design’. Writing for Utility Week, Olliver explains why a robust cyber security strategy is an enabler of net zero.

The drive towards net zero intensified in 2021 with representatives of countries from around the world descending on Glasgow for COP26 and closer to home we have seen a number of UK government policies gaining momentum.

The ban of new sales of petrol and diesel combustion engines by 2030 has seen a five-fold increase in the number of electric vehicles (EVs) sold, and discussion around the use of heat pumps in the home to replace gas boilers is gaining momentum.

Whilst these are all positive steps to meet net zero targets, in the same breath there is also an underlying and growing reference to the virtual 2050 ticking clock and challenges of the infrastructure needed to support the UK energy transition roll out.

Delivering innovation in a fragile UK energy market

As we embark on 2022, there appears to be no immediate answer to the increasing rise in energy prices, and sadly what became the almost weekly announcement of failing energy suppliers is likely to continue – at what pace will only be understood in time.

The price cap in April 2022 is likely to see a further upwards spike in energy costs for end consumers and a further squeeze on margins for service providers in the utilities market. A subsequent review by the regulator is not planned to be undertaken until October 2022 (based on current timetables) resulting in an energy market where cost and associated risk of service delivery continue to increase.

Against this backdrop, energy service providers are expected to deliver new innovative services at pace to maintain the net zero momentum, and at the same time attract end user appetite through price sensitive delivery.

The move to digital platforms and cloud services has been rapid driven by perceived efficiencies and benefits, however, as more innovative services are rolled out it is paramount that the services developed include a proportionate level of ‘security by design’.

The undertaking of a comprehensive risk assessment to identify the protections needed for both the service organisations and end consumers is essential against a backdrop of an ever increasing number of sophisticated malicious attacks.

Alternatively, an ill conceived route to market is to identify the vulnerabilities of a service or solution as you go. Whilst this approach may seem attractive, the potential for subsequent significant cost and PR exposure is high where best practice security controls were not implemented in the drive for low cost, rapid market entry to undercut competitors.

As the drive for innovation intensifies we are likely to see an ongoing increase of new solution providers entering what is an extremely complex, competitive and increasingly price sensitive energy market. There is a risk that return on investment is less focused on security risk management and driven more by rapid, low cost go-to-market strategies where operational risk and security by design is deprioritised due to time, cost and complexity to embed and maintain best practice standards.

Counter to this temptation, malicious attacks on organisations and services are increasing as innovative services become more complex, and the UK energy infrastructure is increasingly interconnected; for example, the combination of demand for EV charging points, the required operational technology (OT) systems and desirable smart end user apps on mobile devices.

This trajectory also raises a wider question over whether the definition of the UK’s critical national infrastructure (CNI) and current defined scope of operators of essential services (OES) need to be revisited and expanded as we accelerate the UK energy transition.

If security by design and the active implementation of best practice security controls is not robustly maintained and managed end-to-end, the UK energy market and the infrastructure upon which the UK energy transition is being built will be become more fragile. The cost to retrofit security best practices will far outweigh the costs associated with implementing and embedding proportionate security and risk management best practice controls, from the outset.

Security by design should be regarded as an enabler and not a barrier

This year, we are likely to see increasing cyber security regulatory activity by competent authorities due to the ongoing demands on UK infrastructure and a growing expectation that the scope of cyber security regulation may increase as well as potentially a raising of the bar in terms of security expectations.

Security by design therefore must be regarded as an integral component of the race to net zero and regarded as an enabler and not a barrier.