They Didn’t Hack Their Way In. They Logged In.

For electric utilities, a stolen identity can turn legitimate access into an attack path, and a cybersecurity incident into a reliability problem.

Electric utilities have spent generations building reliability into the physical infrastructure their communities depend on.

Poles and lines are inspected. Vegetation is managed. Equipment is maintained and replaced before it fails. Substations are monitored. Crews train for emergencies and prepare for storms and outages before they happen.

It is a culture built around a simple principle: identify problems early, because waiting for something to fail can have serious consequences. But there is another infrastructure operating behind today’s electrical system that customers rarely see.

Employees sign into business and operational systems. Engineers use specialized applications. IT administrators manage servers, networks and cloud platforms. Vendors connect remotely to maintain technology. Applications communicate with other applications using credentials of their own.

Every one of those connections begins with an identity being trusted, and that trust is exactly what attackers are trying to steal.

An Attacker May Not Need to Break In

We still tend to picture a cyberattack as someone finding a technical vulnerability and forcing their way through a company’s defenses. That certainly happens. But there is another way in: become someone the organization already trusts.

An employee receives a convincing phishing email and unknowingly gives up a password. A vendor’s credentials are stolen somewhere outside the utility’s network. An administrator’s authenticated session is hijacked. An old account remains active longer than it should. A service account created years ago still has extensive permissions.

None of these scenarios necessarily begins with an attacker defeating the utility’s perimeter security. They begin with an identity.

Imagine that an attacker obtains the credentials of someone with legitimate access to a utility environment. At first, there may be nothing particularly dramatic about what happens next. The attacker signs in. They look around. They learn which systems the account can access and which other identities exist.

If the compromised account has limited permissions, the attack may stop there.

But what if it doesn’t?

• What if that employee accumulated additional access after changing roles?
• What if the compromised identity belongs to an IT administrator?
• What if it belongs to a contractor who was given remote access to troubleshoot a specialized system?
• What if it’s a service account that operates quietly in the background and has considerably more privilege than anyone realized?

One stolen identity can become the beginning of a much larger problem.

The Dangerous Part Is What Happens Next

Attackers don’t necessarily need the first compromised account to have access to something critical. They need it to lead somewhere.

Once inside, an attacker can search for credentials, identify privileged accounts, explore connected systems and look for opportunities to increase their access. That is what makes excessive or poorly controlled privilege so important. An ordinary account may open one door. An administrator account may open dozens.

A vendor account can be particularly interesting because utilities rely on specialized outside expertise for equipment, applications and technology that may need remote support. There is nothing inherently unsafe about providing that access. In many cases, it is operationally necessary.

The problem is what happens when access designed for a trusted vendor falls into someone else’s hands.

• Can the account connect at any time?
• Does it have access to more systems than the vendor actually needs?
• Is multi-factor authentication required?
• Can anyone see what the account is doing during a privileged session?
• Does the access automatically expire when the work is finished?
• Would unusual activity be recognized quickly?

The same questions apply internally. Over time, people change positions. Projects end. Systems are replaced. Temporary permissions become permanent. Accounts created for one purpose remain long after that purpose has disappeared. Access tends to accumulate much more easily than it disappears. An attacker only needs to find the right path through it.

When a Cybersecurity Problem Becomes a Reliability Problem

For most organizations, a cyberattack can disrupt operations, expose information and create significant financial and reputational damage. For an electric utility, there is another consideration. Reliability.

The systems behind the delivery of electricity are increasingly connected to a much larger digital environment. Customer systems, communications infrastructure, engineering applications, cloud services, business platforms, operational technologies and outside vendors all create legitimate requirements for access.

The objective of an attacker does not have to be shutting down the electrical system itself. Disrupting the systems people depend on to operate the organization can be damaging enough.

When a Cyberattack Becomes an Operational Problem

In July 2019, Lewis County Public Utility District was hit by ransomware after a phishing email was clicked. Desktops and servers began encrypting and users were locked out of their machines.

The PUD contained the attack and restored its systems in about two hours, with no data loss and without paying a reported $10 million ransom. Its Information Systems Manager later explained that the potential consequences extended well beyond IT. If critical systems went down, customers could potentially lose access to power, internet and telecommunications services.

That’s the larger issue for any public utility. A cyberattack on digital systems can quickly become a threat to the services the community depends on. Identity Security therefore isn’t simply another cybersecurity technology initiative. It’s part of operational risk management.

Utilities already understand this philosophy in the physical world. A utility doesn’t wait for a transformer to fail before thinking about maintenance. It doesn’t ignore vegetation until a tree takes down a line. It doesn’t wait for an emergency to determine how crews should respond.

Risk is identified, assessed and managed before it becomes an outage. Digital access deserves the same attention.

The Identities Nobody Sees

People aren’t the only identities inside a modern utility. Applications, scripts, APIs and automated processes also need credentials to communicate with other systems. These machine identities can be easy to overlook.

A service account may have been created years ago. Its password may rarely change because nobody wants to risk breaking an important integration. Its permissions may have expanded over time. The employee who originally configured it may no longer be with the organization. Yet the account continues to operate every day.

These identities can become particularly valuable to an attacker because they may have elevated permissions and often operate continuously in the background.

The question is no longer simply: Who has access?

It’s also: What has access, and how much does it actually need?

Identity Security Is About Breaking the Attack Path

No security program can guarantee that an employee will never click the wrong link, a password will never be stolen or a third party will never be compromised.

Identity Security starts from a more practical assumption. Sooner or later, an identity may be compromised. The goal is to make sure that one compromised identity cannot easily become something much worse. That means:

• Limiting unnecessary privileges
• Requiring stronger authentication where the risk warrants it
• Controlling and monitoring privileged access
• Managing vendor connections
• Protecting administrative credentials
• Identifying forgotten accounts
• Managing machine identities
• Removing access when it is no longer required.

Each of those controls removes another opportunity for an attacker to move further. An employee account doesn’t lead to administrative credentials. A vendor can’t wander into systems outside the purpose of its access. Administrators don’t carry permanent unrestricted privilege into everyday work. Service accounts can’t reach systems they have no reason to reach. The attack path gets shorter. Ideally, it ends.

Find the Path Before Someone Else Does

If one employee, administrator, contractor, vendor or service account were compromised tomorrow, how far could that identity actually go?

Answering that question can reveal more than whether an organization has MFA or an Identity and Access Management platform. It can expose accumulated privileges, forgotten accounts, unnecessary vendor access, unmanaged credentials and connections between systems that nobody intended to create.

Most of those issues are far easier to address when they are discovered during an assessment than during an incident.

The electrical grid has changed dramatically over the past several decades. So has the infrastructure required to operate it.

Protecting reliability today means protecting both. The infrastructure everyone can see and the identities quietly accessing the systems behind it.