Iran power plant closure is a warning to all businesses: How to respond

In August, it emerged that a small UK power plant was shut down for four days following a cyber attack attributed to Iranian hackers. It follows multiple attacks on water facilities in the US, which reports indicate are linked to the latest incident.

Not much is known about the UK power plant breach, with the government declining to reveal exactly where it took place. It has confirmed the incident involved a small-scale generator, and that the wider energy system was never at risk.

But a key technical detail is still withheld about whether control systems were directly affected, or if the plant was disconnected merely as a precaution while IT contained the infiltration.

After the first of its kind attack, the government has written to businesses with advice on the steps they should take to protect themselves. How big is the risk, who does it impact, and how should firms react?

Major escalation

The latest attack is “a major escalation” from the recent campaign targeting water facilities in the US, says Markus Mueller, field CISO at Nozomi Networks.

He says attacks on peaker plants like this – which are designed to provide power when needed – can be more dangerous because “things happen fast, there is no buffer, and there can be major impacts”.

Critical national infrastructure is also vulnerable because it often uses legacy technology never meant to be connected to the internet. In the latest incident, the attack path involved a programmable logic controller (PLC) that was not secured following basic best practices.

“If current reporting is correct, this was a publicly exposed PLC that was impacted similarly to what we have seen at US water utilities, where the threat group scans the internet for exposed PLCs using AI-generated scripts,” Mueller tells ITPro.

The attacker then logs into the PLCs using default credentials and proceeds to take them offline by resetting the programming and changing the password and IP address, “making it inaccessible”, explains Mueller.

A risk beyond CNI

The risk goes beyond critical sectors, into the supply chain, other industries, and to firms that rely on the breached organization.

While this incident occurred at a power plant, this is also “a clear warning” for “non-utility commercial sectors”, says Mueller.

He points out that automated scanning scripts used by adversaries “do not differentiate between a power generator, a manufacturing plant, a logistics warehouse, or smart building management systems”.

Any business relying on connected physical systems or industrial controls is at risk. At the same time, supply chain partners and third-party maintenance contractors with remote access into operational technology (OT) environments represent “a major attack vector that adversaries are actively targeting to move laterally into enterprise networks”, says Mueller.

The risk extends “well beyond” large, regulated energy operators, agrees Martin Riley, CTO at Bridewell.

He describes how the UK’s energy system is becoming more distributed, with growing reliance on smaller peaker plants, renewable generators, battery storage and other remotely operated assets.

“Individually, these facilities may represent a small proportion of national capacity, but collectively they are becoming an essential part of how the grid operates,” says Riley.

“That creates a particular challenge because smaller operators and suppliers may fall outside the regulatory thresholds applied to traditional critical infrastructure, while still having connectivity into systems and services the country depends on.”

At the same time, James Neilson, SVP of global at OPSWAT, says it is “a lucky escape” that this attack happened at a small power plant and didn’t impact the UK’s wider energy system.

“Hostile actors now routinely target the UK using cyber attacks, undermining security, the economy and public trust. This form of grey-zone warfare has been present for at least a decade, but sub-threshold activity has increased sharply in recent years.”

Resilience measures

Following the power plant attack, the UK government and National Cyber Security Center have actively urged organizations running critical infrastructure and industrial facilities to audit internet-facing devices and enforce cyber hygiene.

“The guidance emphasizes immediately identifying and pulling exposed OT and PLCs off the public internet, eliminating default vendor passwords and enforcing multi-factor authentication for remote management connections,” explains Mueller.

At this stage, the most important lesson is “understanding asset exposure, attack paths, and the operational consequences of unauthorized access to industrial control systems”, according to Mueller.

Resilience starts with “understanding how an attacker could move through the organization” and “ensuring a compromise in one part of the environment cannot easily reach systems responsible for physical operations”, says Riley.

For operational environments, that means strong IT and OT segmentation, tightly controlled remote access and “security controls proportionate to the potential consequences of an incident”, he advises.

Organizations also need visibility across IT and OT. “If security monitoring operates separately, an attacker may be able to establish themselves in the corporate environment before moving towards operational systems without anyone seeing the complete picture,” warns Riley.

Know what exposed interfaces you have and harden these by using technology and architecture, advises Ian Thornton-Trump, CISO at Inversion6.

At the same time, use firewalls with access control and whitelisting capabilities to “ensure any exposed interfaces can only be connected to by specific IP addresses”, he adds.

Meanwhile, Thornton-Trump advises deploying deception technology to detect the early stages of an attack, including honeypots, as well as taking advantage of the NCSC’s early warning service.

It’s also important to know the enemy you are facing. For example, Iranian and other nation-state groups will often hunt out default credentials immediately to achieve “rapid, low-noise access”, says Neilson.

With this in mind, he advises “assessing and hardening critical systems and infrastructure considering the latest attacks”.

Firms should train for incident response using tabletop exercises at all levels of operations and management, Thornton-Trump adds. “Have a plan that includes cyber-incident responders on retainer and cybersecurity contacts in other companies in your industry vertical – and identify reinforcements and additional resources if you need them. Prolonged downtime of any sort – cyber or otherwise – is avoidable, predictable, and recoverable.”