Cybercriminals have become capable of threatening critical national infrastructure, prompting renewed efforts to shore up cybersecurity. But significant gaps remain.
An audit by the Federal Energy Regulatory Commission (FERC) uncovered cybersecurity compliance deficiencies among U.S. electricity sector entities. The findings included access control risks involving artificial intelligence tools, delays in registering new resources, and misclassification of critical cyber defense systems.
Although most of the cybersecurity processes evaluated met industry standards, FERC found that the deficiencies could affect the reliable operation of the bulk-power system—the network of transmission lines and power generation resources that forms the backbone of the U.S. electricity grid.
Mounting AI Concerns
One area of concern was the increasing integration of AI-driven tools, like chatbots and personal assistants, into networks supporting critical infrastructure.
While these tools can improve customer service and operational efficiency, they can also introduce opportunities for error or manipulation by bad actors, potentially creating entry points for unauthorized access.
As AI becomes more deeply embedded in business operations, its potential to introduce or amplify cybersecurity threats has become a concern across industries.
Recently, a group of leading technology and cybersecurity firms recently called for a global consortium to address AI-powered cyber threats. The group warned that such attacks could soon target “the companies and public services our communities depend on—from hospitals to water treatment plants to the infrastructure that powers the internet.”
The Third-Party Risk
FERC also underscored risks associated with third-party relationships, a longstanding cybersecurity challenge in financial services. As open banking has proliferated, banks have shared data, resources, and systems information with fintech companies.
These relationships have helped modernize banking and create new revenue streams, but they can also introduce vulnerabilities that malicious actors may exploit.
One challenge is ensuring that vendors meet appropriate cybersecurity standards. FERC found that some organizations had failed to properly classify third-party systems, potentially leaving those systems subject to insufficient cybersecurity controls.