Cybersecurity Evolution: Responding to Chinese State-Sponsored Attacks on US Infrastructure

Evolving Cybersecurity Threats

• ⚠️ Volt Typhoon and Salt Typhoon campaigns by the PRC are identified as persistent and adaptive threats targeting US infrastructure.
• 🎯 The Chinese Communist Party actively seeks to cause damage and gather intelligence through these campaigns.

Industry Response and Awareness

• 💡 The energy industry has seen a significant awakening to the threat posed by state actors like the PRC.
• 🛠️ While sophisticated capabilities are employed by threat actors, resilience often relies on basic cybersecurity practices.
• 📈 Utilities, from large investor-owned companies to smaller municipals and cooperatives, are working to bolster their defenses.

Addressing Vulnerabilities

• 🔍 Threat actors of all types, including sophisticated groups and criminals, will exploit any vulnerability in technology.
• 🌐 Rural cooperatives face the same threats as larger utilities, with no differentiation by the attacker.
• 🤝 Enhanced information sharing is crucial for utilities to understand threats and develop mitigation tools.

Information Sharing and Intelligence

• ✅ The current foundation for intelligence and information sharing is good, but there is always room for evolution and improvement.
• ⚡ Timely and effective intelligence sharing from the community is needed to develop appropriate tools and awareness.

Cybersecurity Practices Evolution

• 📈 Chinese state-sponsored actors have compromised US critical infrastructure providers with the intent to disrupt operational controls.
• 🔬 In response, the Energy Threat Analysis Center (ETAC) has honed capabilities to help electric utilities detect evidence of cyber actors.
• 🚀 Threat Hunt memo guides produced by ETAC exemplify industry innovation in translating intelligence into quick risk reduction priorities.