We’ve all seen the headlines: “A major Cyber attack on the U.S. electric grid could cause over $1 trillion in economic impact.” And, as attacks on power stations in Ukraine have demonstrated, such attacks could have disruptive potential.

Nevertheless, to date, there have been no recorded Cyber Attacks on power facilities that have caused a major physical catastrophe or long blackout. The reason for this is that power stations are physically secured, are generally not connected to outside networks, and use industrial protocols. In recent times, power stations have also enjoyed large security upgrades that will continue to make hacking into them harder than it seems.

For this reason, it is only logical that hackers will attempt to attack the grid and associated infrastructure further down the supply chain. The power grid is composed of generation, transmission and distribution systems, all working in unison to provide uninterrupted power supply.

Each of these components has its own challenges and security risks, and there are great efforts invested by authorities worldwide to secure them.

But lately, another element has entered the equation — that of Consumption and its potential manipulation. IoT devices are being rapidly adopted and used everywhere by consumers, enterprises and governments. What if, instead of trying to hack a power plant, a nation-state hacked millions of smart devices connected to a power supply, and used them to manipulate the grid? This would create spikes in local and regional power consumption that in turn could damage power transformation and carrying infrastructure.

Power companies try to balance consumption loads by forecasting peak consumption times, leveraging historical data, weather forecasts and prediction models. Today’s prediction models have become so refined that it is possible to predict the increased demand caused by households boiling kettles at half-time breaks during World Cup soccer matches. However, hacked devices don’t act in the same predictable manner as regular ones- Hacked devices can consume more power late at night when no one is expecting a surge in demand. Without standby power to cope with this demand, outages cannot be avoided. Smart kettles have already been demonstrated to have weak security and could easily be exploited for such “on/off” attacks (not to mention other power-devouring appliances like smart TVs, fridges and washing machines).

The post Cyber attacks may not be what you expect appeared first on SecuriThings.