Ransomware defence could keep the lights on for millions

A new algorithm could help prevent ransomware attacks on power companies in the United States which could cause national blackouts affecting millions

Researchers in the United States have developed an algorithm to help power companies prioritise security investments and fend off a ransomware attack that could cause millions to lose electricity.

No single company has enough resources to protect the entire US power grid, the research group at Purdue University discovered. However, computer-assisted analysis of the most crucial security gaps would create a map showing where individual companies could work together to focus on security measures.

“Multiple companies own different parts of the infrastructure,” says Saurabh Bagchi, a professor in the Elmore Family School of Electrical and Computer Engineering and Centre for Education and Research in Information Assurance and Security at Purdue. “When ransomware hits, it affects lots of different pieces of technology owned by different providers, so that’s what makes ransomware a problem at the state, national and even global level. When you are investing security money on large-scale infrastructures, bad investment decisions can mean your power grid goes out, or your telecommunications network goes out for a few days.”

The biggest ransomware attacks in history have happened in the past year, affecting most sectors of critical infrastructure in the United States, including grain distribution systems in the food and agriculture sector and the Colonial Pipeline, which carries fuel across the US East Coast.

The researchers tested the algorithm in simulations of previously reported hacks on four infrastructure systems: a smart grid, industrial control system, e-commerce platform and web-based telecommunications network. They found that use of this algorithm results in the best allocation of security investments to reduce the impact of a cyberattack.

“No one has an infinite security budget,” says Bagchi. “You must decide how much to invest in each of your assets so that you gain a bump in the security of the overall system.”

The Purdue research team comprises professors Shreyas Sundaram and Timothy Cason and former PhD students Mustafa Abdallah and Daniel Woods. Their findings appear in a paper presented at this year’s IEEE Symposium on Security and Privacy

Power companies can join forces to fight ransomware

Power grids are so interconnected that the security decisions of one power utility company can impact the operations of other electrical plants, say the researchers. If the computers controlling one area’s generators don’t have adequate security protection, then hacking those computers would disrupt the energy flow to generators in another area. And as not all of the grid’s utilities have the same security budget, it can be hard to ensure critical points of entry get the most investment in security protection.

The algorithm that Purdue researchers developed would compel security decision-makers to allocate security investments in a way that limits ransomware effects. Power utility companies would be incentivised to invest more in security measures for the controls over a network of generators rather than for the protection of a single generator.

As director of Purdue’s Centre for Resilient Infrastructures, Systems, and Processes, Bagchi has worked with the US Department of Defence, Northrop Grumman, Intel, Adobe, Google and IBM in his research. 

Bagchi’s research group is working to make the algorithm more scalable and able to adapt to an attacker who may make multiple attempts to hack into a system. The researchers’ work on the algorithm is funded by the National Science Foundation, the Wabash Heartland Innovation Network and the Army Research Lab.

Share

Featured Articles

KPMG UK announces major alliance expansion with Google Cloud

The investment underpins the ongoing alliance to help UK clients digitally transform their business through Google Cloud’s leading technology

Kyndryl driving Stellantis’ IT infrastructure transformation

Stellantis is adopting Kyndryl Bridge to enable improved management of IT infrastructure and real-time insights across its technology environment

The cutting edge: Edge computing trends to watch in 2023

As the IoT has grown and the volume of data has increased, edge computing has become increasingly important. We look at the edge trends to watch this year

Shadow APIs pose serious threat to fintechs, report finds

Cloud & Cybersecurity

IBM and NASA to research impact of climate change with AI

AI & Machine Learning

'Change is the new normal' Accenture cloud study finds

Cloud & Cybersecurity