US utilities use Red team to asses IoT Security

The U.S. electric industry has responded to a steady stream of cyberthreats with more rigorous red-teaming and by using artificial intelligence, utility executives said.

“We’re penetrating our own system to ensure that we are moving the envelope,” said Brian Harrell, Duke Energy Corp.’s managing director of enterprise protective services. “We’re trying to find the vulnerabilities before anyone else does.”

Outsourcing is an option

Big power companies like Duke Energy and PG&E can run their own in-house intelligence organizations, with analysts picking apart threat data. The smaller electric cooperatives serving rural communities across the country, however, tend to lack the resources to do that.

For example, smaller companies frequently try to “‘dual hat’ their control systems people and tell them – you also need to perform these cybersecurity tasks, but often there is a skills gap,” Marty Edwards, an industrial cybersecurity expert, told CyberScoop.