One unpatched device in a home solar installation can be the entry point for an attack that leaves a whole country without power, security experts warn. If millions of inverters share the same weakness, breaking a single prosumer’s kit becomes a problem for the entire grid – including households with no panels on the roof.
The warning came at the Energy Days session on cybersecurity of the energy sector and critical infrastructure. Specialists from PSE, PGE Systemy, PTPiREE and EY argued that the industry can no longer plan for perfect protection, only for survival after a breach.
– We must be able to function during an incident, or recover the business and technological capabilities we deliver to customers very quickly – said Krzysztof Malik, director of the cybersecurity department at PGE Systemy.
Assume the intruder will get in
Malik said the old approach, treating security as a guarantee that nobody would break in, has been replaced by the assumption that someone eventually will.
– Cyber resilience can be measured, but it is difficult to measure it with the number of certificates or cybersecurity systems you own – said Krzysztof Malik.
Radosław Dumański, director for ICT security at Polskie Sieci Elektroenergetyczne, compared readiness to a reflex that has to be rehearsed before a real emergency.
– It has to be exercised through the scenarios we can expect, so that when something happens we have „muscle memory”: we know what to do, how to behave, not to panic, but reach for what we need and act calmly – said Radosław Dumański.
Jakub Teska, partner and member of the cybersecurity team at EY, said drills usually cover single systems, while what matters is bringing back whole processes.
– It is about whether we are able to restore not only systems, but working processes – said Jakub Teska.
Meters, supply chains and the December wake-up call
Katarzyna Zalewska-Wojtuś, director of the office of the Polish Power Transmission and Distribution Association (PTPiREE), described a project run with an external consultancy, in which distribution system operators studied the legal environment for remote-read meter security and defined EU and national requirements.
The exercise, which she described as close to military drills, produced seven main requirements on communication, encryption and physical security. In her view they should be written into regulations, including the metering ordinance. Physical protection of meters raised no objections, but supply-chain transparency does: tenders contain declarations of origin that nobody verifies.
– What happens when a declaration is made under the relevant rigours, and intuition suggests the components are not produced in the indicated country? – asked Katarzyna Zalewska-Wojtuś.
The coordinated attacks of 29 December, called by CERT Polska the first cyberattack on Poland’s energy sector with a purely destructive aim, remain the industry’s reference point. At least 30 wind and photovoltaic farms were targeted, along with a manufacturing company and a large CHP plant supplying nearly half a million consumers. In August CERT Polska disclosed that a smaller CHP plant, serving around 50,000 residents, was also hit. Malik pointed to the attackers’ efficiency in the OT environment: they got in through outdated devices and firewalls, repeated passwords and no multi-factor authentication.
The December events caused no blackout and no heating outage. In the large CHP plant an EDR endpoint protection system blocked an attempt to launch a data-destroying wiper.
– We are glad EDR worked, but with the access they obtained it seems almost impossible that the attackers did not do more damage. I am quoting a speculation from a colleague in the industry: it was meant to be this way – said Radosław Dumański.
Prosumers as the soft spot
Zalewska-Wojtuś pointed to cyber risks in prosumer installations, which threaten both their owners and the grid. Apps that manage panels and monitor generation usually link home assets through the household internet connection.
– We often use default or repeated passwords. We connect these devices with others at home, we do not isolate them from other connections – said Katarzyna Zalewska-Wojtuś.
That exposes the prosumer to malware and to interference in other systems on the same link, and can mean voltage loss and a potential blackout on the operator’s side. Distribution system operators have no say over consumer behaviour or over devices installed by installation suppliers: if all formalities are in order, no verification takes place.
– It is enough to break the security of one device and you simultaneously break it in millions. The power of a single device is not large, but cumulated it can exceed the stability threshold of the whole system – warned Radosław Dumański.
PSE published a guide for renewable energy prosumers.
– We have no stronger argument today than to advise and educate prosumers – said Radosław Dumański.
Cross-sector drills, CSIRT Energia and NIS2
Teska stressed cooperation between sectors, noting that the availability of power and the duration of backup supply are decisive.
– Telecommunications, the energy sector and the financial sector can be affected at the same time, not necessarily by the same incident, but its effects will appear at once in all these sectors – said Jakub Teska.
PSE is preparing to launch the sectoral CSIRT Energia team, meant to help companies react to attacks and share threat information. Sectoral CSIRTs are being created under the amended national cybersecurity system act, which implements the EU’s NIS2 directive.
– The first fines may appear in April 2028. But the law has been in force since 3 April this year, for several months already – said Radosław Dumański.
Teska said progress should be measured by changing parameters inside organisations, not by the number of projects – and, after December, by the moment when access points without multi-factor authentication reach zero. Zalewska-Wojtuś assessed that large energy companies are ready for the new duties. Enforcement lies with the minister of energy, who can impose fines for failures such as a missing risk assessment.
Źródło: WNP.PL, Fot. anatoliy_gleb / Shutterstock
