A new executive order signed on Friday by U.S. President Donald Trump prohibits the acquisition of bulk-power system equipment that could contain intentional backdoors planted by foreign adversaries.
Incidents where threat actors targeted a country’s power grid and even caused disruptions are not unheard of, and even the United States reportedly targeted Russia’s grid in such attacks.
The U.S. government appears to be concerned that foreign adversaries could be trying to plant malicious or vulnerable equipment in the country’s power grid. That is why the latest executive order prohibits the acquisition of bulk-power system electric equipment that is designed, developed, manufactured or supplied by an entity that is “controlled by, or subject to the jurisdiction or direction of a foreign adversary.”
This applies to transactions that have been determined to pose a risk to the grid itself, to critical infrastructure or the economy, or to national security or the security and safety of people.
“The bulk-power system is a target of those seeking to commit malicious acts against the United States and its people, including malicious cyber activities, because a successful attack on our bulk-power system would present significant risks to our economy, human health and safety, and would render the United States less capable of acting in defense of itself and its allies,” President Trump wrote.
“I further find that the unrestricted acquisition or use in the United States of bulk-power system electric equipment designed, developed, manufactured, or supplied by persons owned by, controlled by, or subject to the jurisdiction or direction of foreign adversaries augments the ability of foreign adversaries to create and exploit vulnerabilities in bulk-power system electric equipment, with potentially catastrophic effects,” he added.
Learn more about threats to industrial systems at SecurityWeek’s 2020 ICS Cyber Security Conference and SecurityWeek’s Security Summits virtual event series
The order also instructs agencies to identify, monitor or replace equipment that could pose a risk.
“It is imperative the bulk-power system be secured against exploitation and attacks by foreign threats,” said U.S. Secretary of Energy Dan Brouillette. “This Executive Order will greatly diminish the ability of foreign adversaries to target our critical electric infrastructure.”
After the executive order was signed, the U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response (CESER) posted a tweet saying that “malicious actors have sought to leverage unauthorized access to the bulk power system against the U.S.for over a decade.”
Related: Security of North American Energy Grid Tested in GridEx Exercise
Related: Bill to Protect U.S. Energy Grid From Cyberattacks Passes With NDAA
Related: European Electrical Energy Organization Discloses Breach