Phishing Attacks and the National Electric Power Grid

In 2019, the U.S. Government Accountability Office (GAO) warned about the vulnerability of the U.S. power grid’s supply chain. Any component of the grid could be hacked due to phishing or other types of cyberattacks, which could disrupt the electricity supply, and if a nuclear source is hacked, it would be a major disaster.

Phishing is a type of cyberattack in which someone acting as a legitimate organization attempts to trick a target into providing personally identifiable information, through emails, websites, text messages, as well as other forms of electronic communication. Cybercriminals are interested in stealing credit card details, usernames, passwords, bank account information and other credentials. They use this information for malicious purposes, like identity theft, hacking, stealing money through credit cards and bank accounts, etc.  The aim is to exploit human psychology by pressing the right buttons of a target, in order to get them to take action, like make a phone call or click a link that will start the scamming process.

Some of the different types of phishing attacks include:

1. Spear phishing: This type of attack is crafted to trick a specific person. The attackers may already have information about the targeted person.
2. Whaling: This is a sub-type of spear phishing and is targeted to specific individuals with high-net worth, like business executives, celebrities, etc.
3. Smishing: This type of an attack is typically deployed through an SMS message. Smishing has gained popularity with the rise in SMS messaging between businesses and consumers.
4. Vishing: This type of attack is carried out through a phone call. A pre-recorded message may be used to call the target.

What makes the national electric grid vulnerable to cyberattacks?

The following are some challenges that make the U.S. electricity grid particularly vulnerable:

1. It has three components: generation and storage; transmission; and distribution of electricity to commercial, residential and industrial users. Electricity generation sources include: nuclear, chemical, wind, solar, and hydroelectric.
2. The distribution systems may be connected to smart meters, solar panels, and network devices.
3. The national power grid consists of privately owned grids and substations.
4. There are three power grid regions – eastern, western, and Texas (ERCOT), and each region has its own policies and cybersecurity strategies. Each stakeholder has its own budget and priorities that are not always aligned with the national level.
5. Each power grid has its own machinery, equipment and power generation methods, so there is a lack of uniformity.