Ransomware defence could keep the lights on for millions

Researchers in the United States have developed an algorithm to help power companies prioritise security investments and fend off a ransomware attack that could cause millions to lose electricity.

No single company has enough resources to protect the entire US power grid, the research group at Purdue University discovered. However, computer-assisted analysis of the most crucial security gaps would create a map showing where individual companies could work together to focus on security measures.

“Multiple companies own different parts of the infrastructure,” says Saurabh Bagchi, a professor in the Elmore Family School of Electrical and Computer Engineering and Centre for Education and Research in Information Assurance and Security at Purdue. “When ransomware hits, it affects lots of different pieces of technology owned by different providers, so that’s what makes ransomware a problem at the state, national and even global level. When you are investing security money on large-scale infrastructures, bad investment decisions can mean your power grid goes out, or your telecommunications network goes out for a few days.”

The biggest ransomware attacks in history have happened in the past year, affecting most sectors of critical infrastructure in the United States, including grain distribution systems in the food and agriculture sector and the Colonial Pipeline, which carries fuel across the US East Coast.

The researchers tested the algorithm in simulations of previously reported hacks on four infrastructure systems: a smart grid, industrial control system, e-commerce platform and web-based telecommunications network. They found that use of this algorithm results in the best allocation of security investments to reduce the impact of a cyberattack.

“No one has an infinite security budget,” says Bagchi. “You must decide how much to invest in each of your assets so that you gain a bump in the security of the overall system.”

The Purdue research team comprises professors Shreyas Sundaram and Timothy Cason and former PhD students Mustafa Abdallah and Daniel Woods. Their findings appear in a paper presented at this year’s IEEE Symposium on Security and Privacy. 

Power companies can join forces to fight ransomware

Power grids are so interconnected that the security decisions of one power utility company can impact the operations of other electrical plants, say the researchers. If the computers controlling one area’s generators don’t have adequate security protection, then hacking those computers would disrupt the energy flow to generators in another area. And as not all of the grid’s utilities have the same security budget, it can be hard to ensure critical points of entry get the most investment in security protection.

The algorithm that Purdue researchers developed would compel security decision-makers to allocate security investments in a way that limits ransomware effects. Power utility companies would be incentivised to invest more in security measures for the controls over a network of generators rather than for the protection of a single generator.

As director of Purdue’s Centre for Resilient Infrastructures, Systems, and Processes, Bagchi has worked with the US Department of Defence, Northrop Grumman, Intel, Adobe, Google and IBM in his research. 

Bagchi’s research group is working to make the algorithm more scalable and able to adapt to an attacker who may make multiple attempts to hack into a system. The researchers’ work on the algorithm is funded by the National Science Foundation, the Wabash Heartland Innovation Network and the Army Research Lab.