As FBI Warns of Rising Cyber Threats in Renewable Energy Sector, runZero Demonstrates Effectiveness in Protecting Critical Infrastructure with No Impact on ICS Processes & OT Device Performance
AUSTIN, TEXAS — July 24, 2024 — The U.S. Department of Energy’s (DOE’s) National Renewable Energy Laboratory (NREL) has released a public report summarizing the outcomes of the second cohort of the Clean Energy Cybersecurity Accelerator (CECA) program. As previously announced, runZero, a leading provider of Cyber Asset Attack Surface Management (CAASM), was selected as the first of two participants from numerous applications for this rigorous months-long evaluation.
CECA Cohort 2 aims to bridge the gap between the widespread use of tools for monitoring information technology (IT) networks and the less common adoption of tools for actively monitoring operational technology (OT) systems. The solutions assessed by CECA aimed to identify risks that asset owners might miss due to incomplete visibility of systems or device configurations. The goal of these solutions is to improve the visibility of OT systems, illuminate OT networks and assets, and clarify any associated risks. Capabilities such as asset identification, attack surface enumeration, and configuration management can all help OT asset owners gain a better understanding of their overall risk posture.
CECA’s work comes at a critical time. On July 1, the FBI issued a warning about increasing cyber attacks in the renewable energy sector. They advise organizations to monitor network activity for any unusual or suspicious traffic and activity. In addition, they have recommended other critical measures to overcome cybersecurity challenges. The evaluation of the runZero Platform demonstrated its effectiveness in addressing the urgent cybersecurity challenges facing the modern electric grid, including the most recent FBI warning.
CECA concluded that runZero’s discovery methods significantly improve visibility into utility infrastructure with detection of all IP-addressable devices in the test environment. This was accomplished without impacting the performance of industrial control systems (ICS) assets or interfering with ongoing SCADA processes and communications. runZero leverages a unique combination of proprietary active scanning, novel passive discovery, and integrations to provide accurate, comprehensive visibility across IT, OT, and IoT environments, including delivering in-depth insights into potential risks and exposures that attackers could leverage.
According to the CECA report, runZero’s active scanning methods in the CECA test environment did not negatively impact system performance, challenging the widely held industry belief that active scanning inherently disrupts operations. The conclusion that active scanning in this environment proved safe with runZero is significant, opening the possibility of expanding scanning beyond traditional passive collection methods. CECA’s findings could be transformational for the energy industry since active scanning provides more comprehensive data about connected devices compared to passive discovery, giving security teams improved visibility to better secure ICS environments.
“runZero is thankful to DOE and NREL for the chance to showcase the effectiveness of our CAASM solution. The tests confirm that the runZero Platform and our unique combination of active scanning and native passive discovery provide advanced visibility into assets – both managed and unmanaged – without disrupting normal business operations. This serves as a crucial deterrent against external attacks,” said Rob King, director of research at runZero.
Evaluation Criteria and Key Results for the runZero Platform
The evaluation plan outlined four scenarios to examine different aspects of the solution: initial discovery, change discovery, passive discovery, and scale discovery. Each scenario involved a scientific and repeatable set of procedures and data collection methods. The runZero Platform demonstrated the following key capabilities:
Accurately identified all IP-addressable assets in the environment and collected detailed information about each identified device and all open ports, including the ability to detect OT protocols like Modbus.
Identified and alerted on the introduction of new devices and changes to existing devices in the environment.
Built an accurate inventory of assets through proprietary active scanning and passive traffic sampling, discovering all IP-addressable IT and OT assets.
Cybersecurity is a complex and shifting field full of unique challenges. Threats, risks, architectures, and technologies will continue to evolve as the energy sector undergoes significant transformations. Innovation of solutions should be enabled to evolve as well. Using solutions such as those offered by runZero to identify control system assets and to monitor changes in that equipment is expected to improve the security of the industry as a whole, continued the report.
CECA is managed by NREL and sponsored by the Department of Energy’s (DOE’s) Office of Cybersecurity, Energy Security, and Emergency Response (CESER) and utility partners in collaboration with DOE’s Office of Energy Efficiency and Renewable Energy (EERE).
To learn more about runZero’s participation in the NREL CECA Program you can read their news story here.
To download the free and publicly available report, please visit https://www.nrel.gov/docs/fy24osti/89105.pdf.
About Version 2 Limited
Version 2 Digital is one of the most dynamic IT companies in Asia. The company distributes a wide range of IT products across various areas including cyber security, cloud, data protection, end points, infrastructures, system monitoring, storage, networking, business productivity and communication products.
Through an extensive network of channels, point of sales, resellers, and partnership companies, Version 2 offers quality products and services which are highly acclaimed in the market. Its customers cover a wide spectrum which include Global 1000 enterprises, regional listed companies, different vertical industries, public utilities, Government, a vast number of successful SMEs, and consumers in various Asian cities.
About runZero
runZero, a network discovery and asset inventory solution, was founded in 2018 by HD Moore, the creator of Metasploit. HD envisioned a modern active discovery solution that could find and identify everything on a network–without credentials. As a security researcher and penetration tester, he often employed benign ways to get information leaks and piece them together to build device profiles. Eventually, this work led him to leverage applied research and the discovery techniques developed for security and penetration testing to create runZero.