Real testing of the business continuity plan and disaster recovery is absolutely essential in cyber security, said Yugo Neumorni – President of the CIO Council at the Energy Cyber Security Forum, according to Financial Intelligence.

“The idea of testing a business continuity and disaster recovery is absolutely essential for any company. And in energy and in the OT (operational technology) area, it is not easy to do. It is very important that the lessons learned from testing are tested regularly,” he said.

“When it comes to the energy sector, in 2014, Adm. Michael Rogers, director of the NSA, warned that it was only a matter of time before penetrating the U.S. electricity grid. Such claims have been reiterated in 2016 and on other occasions. In 2015 it was the first confirmed attack on an electricity grid, the famous case in Ukraine.”

Yugo Neumorni explained: “The energy sector is a highly attacked sector. In May 2023, Denmark’s energy infrastructure was attacked, it is a simultaneous attack, carried out against 30 energy companies, on the same day, at the same moment – energy transmission, distribution and production companies. 22 of them were penetrated, reaching the process control area, SCADA. The story started badly, but ended well.

According to Yugo Neumorni, the Operational Technology (OT) area has many challenges: “There are plants that operate with SCADA systems since the 2000s and operate very well, generate current, being mature at the level of 20 years, but from an IT point of view they are a “disaster”, I mean the cyber area. We cannot update – this is the primary rule in IT. Segmentation is not easy, there is a very large geographically distributed area – there are areas where even perimeter control cannot be done very well physically. We are talking about a very large attack surface. Everything that means the operational technology part is found in energy, not only in Romania, but also abroad.”