Edição original em inglês. A tradução desta nova análise está em preparação.
Historical case · 2015
Ukraine’s 2015 Power Grid Attack: Defending the Operator’s Ability to Act
The response boundary includes operational control, communications and the people restoring service.
In this analysis
What happened and what is established
CISA’s joint retrospective identifies a December 2015 cyberattack against Ukrainian energy-distribution companies that caused unplanned outages. [1] A 2020 US indictment alleges GRU involvement in destructive activity against Ukraine, including the 2015 and 2016 power-grid attacks. [2] An indictment is an allegation, not a conviction. The two annual incidents are treated separately because they raise different operational questions.
Why the case changed the discussion
Our analysis focuses on the ability to operate during loss of digital trust. When a control environment is affected, availability of customer service, field communications, engineering support and authorised manual procedures becomes part of recovery. An IT incident can therefore create a resource and coordination problem extending well beyond the compromised workstation.
What could reduce exposure today
Review remote access into operational environments, privilege boundaries and the paths connecting business systems to control functions. Use appropriately engineered authentication and access controls, with tightly managed exceptions where equipment limitations exist. Preserve operational logs independently where feasible. Test these choices against safety and availability requirements rather than assuming that an office-network policy can be copied unchanged.
How the response could be stronger
Prepare for a loss of trustworthy remote control and validate the actual alternatives with field personnel. Maintain communications that do not depend entirely on the affected environment. Cyber responders should support, rather than displace, operational authority. Prioritise restoration using engineering evidence and keep the public informed about service effects without speculative attribution.
Policy decision and exercise
A useful exercise removes the normal remote-management service during a busy shift. Can the organisation locate qualified personnel, issue trusted instructions and record equipment state? Measure the time to a safe operating decision, not merely the time to detect a suspicious login. Treat manual recovery capability as an owned, maintained service with training and resources, not as an untested sentence in a plan.
References
- CISA, FBI and NSA · Russian threats to critical infrastructure · 11 January 2022
- US Department of Justice · Six GRU officers charged · 19 October 2020
Original editorial analysis and paraphrases. Recommendations are distinguished from documented facts; references do not imply institutional endorsement.