'Keeps Me Up At Night': Andy Ogles Warns Cyber Attacks On Utilities Are The 'Next Battlefield'

Forbes Breaking News

During a House Homeland Security Committee hearing in July, Rep. Andy Ogles (R-TN) spoke about cyber attacks on utilities infrastructure.

Transcript

00:00Neil's back. I now recognize the gentleman from Tennessee, Mr. Ogles, for five minutes of questions.

00:04Thank you, Mr. Chairman, and thank you to your witnesses for being here.

00:07Obviously, this is a high-stakes issue. I mean, it's the next battlefront, if not the battlefront,

00:13as we move forward. And when you look at the China threat that Ms. Zetter, I think you've

00:19touched on, or all of you have touched on. But specifically, I want to start with Ms. Bolton.

00:23So, formerly, I was county executive in my community. And what I can say is that, you

00:31know, although we were one of the fastest-growing counties in the state of Tennessee, number

00:36one producer for manufacturing jobs in the state of Tennessee while I was a county executive,

00:41I can tell you that from a cyber and IT, OT perspective, we were arguably vulnerable.

00:48Please expand on that vulnerability when you look at bad actors as it relates to kind of,

00:53you know, just our infrastructure security and what the consequences might be if there

00:59was a coordinated, systematic attack against those local communities.

01:03So, a lot of what we see, and you're completely right, a lot of what we see is that the threat

01:09actors are targeting the most vulnerable organizations, right? Many times, those are smaller organizations

01:15without cybersecurity expertise. They're at the county level. They're at the local level.

01:20And you see actors either targeting those for, you know, for target practice, learning, and

01:28then moving to bigger systems, or they're doing it in a coordinated manner across a number

01:33of different states and localities. Particularly, we see that in the energy sector. And they're

01:38using that as a means to prepare the battlefield, if you will, for if they're in a contingency.

01:46If it's China, for example, if they're sitting on our networks, that is extremely dangerous. Even if

01:54they're not conducting any particular operations right now, one, we can't guarantee that they're

01:58off the networks, even when we find them. We find them too late. We find them three years after the

02:04fact. And what we don't want to have happen, if, for example, we're planning for a 2027 contingency,

02:11then we need to start doing the work now to build resiliency, defense in depth, the ability for those

02:18smaller local and county entities to be able to secure their, to secure all of those ports, right?

02:25Secure the remote access, put in stronger multi-factor authentication, modernize their legacy IT.

02:32And that's why I think it's so important to reauthorize the state and local cyber grant program,

02:37because without those resources, like I said, most of those localities are using all the funding

02:43for physical security and not OT.

02:47And Mr. Chairman, you know, again, coming from that, that local governance background, county executive,

02:54and I can, I'll speak for Tennessee. Obviously, everybody knows Nashville and knows Memphis,

02:59larger cities with more arguably or hopefully more robust systems. But a lot of Tennessee is rural,

03:05just like a lot of states across the country. And what you see are electric cooperatives. So just

03:11like the county may be vulnerable to that infrastructure attack, my guess is, in most

03:16cases, so are those local cooperatives. So is some of the water cooperatives as well. And so as we look

03:23forward to, again, the next battlefield and what keeps me up at night, and quite frankly, Mr. Chairman,

03:28what I would argue that the most important, some of the most important work that we'll do on

03:32this committee, this whole committee is what we're doing in cyber, as we prepare this country for that

03:38next battle. And it's going to be on our computers, it's going to be across our networks. And I would

03:44argue it's going to be in our local rural communities that they're going to hit first, because then they

03:49can switch cheese, our electrical grids and our water systems and our water treatment plants, etc.

03:53That's what keeps me up at night. So with that, I'd love to stay on this topic and just kind of go

03:59down the line. We'll start with you, Ms. Zetter, to see what you might want to add to this subject

04:03matter, please. I think you're absolutely right in terms of the small utilities and cooperatives like

04:09that. They don't have the money, they don't have the resources, they don't have the expertise on

04:14staff, they don't even hire security people. But I want to also say that, you know, we sort of

04:19anticipate that the large organizations would be more secure. And if you look at what happened

04:27to Colonial Pipeline in 2021, we see that this was really a major organization, critical infrastructure,

04:33supplying a lot of gasoline to the East Coast. And yet, Colonial Pipeline at the time that it was

04:39attacked did not have a CISO on staff. They also had a legacy system that the attackers got in an old

04:45VPN account. They were no longer using, but hadn't bothered to disable. And they came in through a

04:51password that potentially was, well, it was leaked on the internet. So the employee who had the password

04:58had used it for other accounts, and then it was leaked on the internet in other breaches. One other

05:03point about that was the attackers, we think, only got to the IT network, didn't actually make it to the

05:10OT network. But Colonial Pipeline shut down the pipeline because they feared that the attackers

05:16would get to the OT network and then encrypt it and lock it. But when the CEO of Colonial Pipeline

05:21testified to Congress, he testified that they had very secure, highly segmented OT and IT networks.

05:30But if they were that confident that the networks were segmented, then they wouldn't have had to shut

05:34down the pipeline as a precaution. So I just want to say that, yes, those smaller entities are a big

05:41issue and a prime concern, but also the larger entities are having the same problems and not

05:47keeping up. Yeah, thank you, ma'am. And I apologize, Mr. Chairman, I'm over time, but I yield back.

Category

Transcript

Be the first to comment

Recommended