Ransomware defence could keep the lights on for millions

Share
A new algorithm could help prevent ransomware attacks on power companies in the United States which could cause national blackouts affecting millions

Researchers in the United States have developed an algorithm to help power companies prioritise security investments and fend off a ransomware attack that could cause millions to lose electricity.

No single company has enough resources to protect the entire US power grid, the research group at Purdue University discovered. However, computer-assisted analysis of the most crucial security gaps would create a map showing where individual companies could work together to focus on security measures.

“Multiple companies own different parts of the infrastructure,” says Saurabh Bagchi, a professor in the Elmore Family School of Electrical and Computer Engineering and Centre for Education and Research in Information Assurance and Security at Purdue. “When ransomware hits, it affects lots of different pieces of technology owned by different providers, so that’s what makes ransomware a problem at the state, national and even global level. When you are investing security money on large-scale infrastructures, bad investment decisions can mean your power grid goes out, or your telecommunications network goes out for a few days.”

The biggest ransomware attacks in history have happened in the past year, affecting most sectors of critical infrastructure in the United States, including grain distribution systems in the food and agriculture sector and the Colonial Pipeline, which carries fuel across the US East Coast.

The researchers tested the algorithm in simulations of previously reported hacks on four infrastructure systems: a smart grid, industrial control system, e-commerce platform and web-based telecommunications network. They found that use of this algorithm results in the best allocation of security investments to reduce the impact of a cyberattack.

“No one has an infinite security budget,” says Bagchi. “You must decide how much to invest in each of your assets so that you gain a bump in the security of the overall system.”

The Purdue research team comprises professors Shreyas Sundaram and Timothy Cason and former PhD students Mustafa Abdallah and Daniel Woods. Their findings appear in a paper presented at this year’s IEEE Symposium on Security and Privacy

Power companies can join forces to fight ransomware

Power grids are so interconnected that the security decisions of one power utility company can impact the operations of other electrical plants, say the researchers. If the computers controlling one area’s generators don’t have adequate security protection, then hacking those computers would disrupt the energy flow to generators in another area. And as not all of the grid’s utilities have the same security budget, it can be hard to ensure critical points of entry get the most investment in security protection.

The algorithm that Purdue researchers developed would compel security decision-makers to allocate security investments in a way that limits ransomware effects. Power utility companies would be incentivised to invest more in security measures for the controls over a network of generators rather than for the protection of a single generator.

As director of Purdue’s Centre for Resilient Infrastructures, Systems, and Processes, Bagchi has worked with the US Department of Defence, Northrop Grumman, Intel, Adobe, Google and IBM in his research. 

Bagchi’s research group is working to make the algorithm more scalable and able to adapt to an attacker who may make multiple attempts to hack into a system. The researchers’ work on the algorithm is funded by the National Science Foundation, the Wabash Heartland Innovation Network and the Army Research Lab.

Share

Featured Articles

Will Trump’s Tariffs Threaten Global Technology Trade?

Global supply chains for renewable energy technology faces disruption as the US imposes new tariffs on Chinese imports, threatening price increases

Google Drops Diversity Targets as US Tech Firms Review DEI

Alphabet’s search and advertising unit joins Meta and Amazon in reassessing workplace programmes following Trump administration executive orders

How Quantum Computing Could Add £212bn to UK Economy by 2045

Oxford Economics research shows quantum technology could increase UK productivity by 7% by 2045, with pharmaceutical and defence sectors leading adoption

Why UK’s MoD is Investing £50m in AI and Data Analytics

Data & Data Analytics

SAP: Why The UK Faces AI Adoption Hurdles Amid Global Race

AI & Machine Learning

Quantinuum: The First Quantum-Generated Data For AI

AI & Machine Learning