One step ahead of emerging threats: cybersecurity is key in the energy sector
As the energy sector becomes increasingly digital and its systems more interconnected, cybersecurity is becoming ever more important. Effective cybersecurity depends on technology, sound operating practices and, above all, people. Ultimately, the entire energy-sector ecosystem is only as strong as its weakest link, says Enerim’s Chief Information Officer, Mika Holsti.
Cybersecurity is becoming increasingly important across the energy sector. Digitalisation, automation and system integrations make operations more efficient, but they also increase reliance on secure, dependable systems.
Enerim’s Chief Information Officer, Mika Holsti, says cybersecurity has become a growing priority in recent years—not only for energy companies, but also for their service providers.
“We are living in exceptional times, and the importance of cybersecurity cannot be underestimated. New threats are constantly emerging. An organisation must know what is moving through its network, what kinds of threats it faces and which mechanisms are in place to protect against them,” he says.
Security is fundamental to Enerim’s business. As a provider of SaaS services to the energy sector, the company processes large volumes of data that are critical to its customers’ operations. This work also gives Enerim a close-up view of the varying levels of cybersecurity maturity among energy companies.
People are at the heart of cybersecurity
Discussions about cybersecurity often focus on technology. Holsti emphasises that while technical safeguards are essential, effective cybersecurity ultimately depends largely on how people behave.
“Everything starts with users. We can put strong technical controls in place, but we must also ensure that people know how they are expected to act.”
In practice, this means training employees and giving them clear guidance. Holsti points to artificial intelligence as a particularly topical example.
“An organisation can define precisely what information may be entered into AI services, but cybersecurity is only realised when employees know the guidelines and follow them.”
People are only one part of the equation; robust technical controls are equally important. Enerim has invested in system monitoring and the detection of anomalous activity, with the aim of identifying threats as early as possible.
Holsti likens proactive threat detection to preventing a fire:
“We need to detect the threat while someone is still reaching for the matches.”
Plans must also be tested
In the energy sector, cybersecurity is inseparable from business continuity. If a critical service is disrupted, the key question is how quickly the organisation can respond and restore operations.
Many organisations naturally have contingency plans in place. Holsti says the crucial next step is to determine whether those plans have been tested.
“A plan may look excellent on paper, but if the process has not been practised, you still do not know how it will work in a real situation.”
Enerim conducts tabletop exercises with its customers to prepare for critical situations. One exercise might simulate the failure of a key service: What happens in the first minutes and hours? Who takes action? When and how are customers informed? And how does recovery begin?
Such exercises often bring very practical areas for improvement to light.
“When an incident is under way, there is no time to start thinking everything through from scratch. That is why these matters should be addressed in advance.”
The entire ecosystem must be strong
Energy-sector systems are becoming increasingly interconnected. Holsti explains that a company’s cybersecurity can no longer be viewed in isolation from that of its customers, partners and service providers.
“Companies are only as resilient to disruptions as the weakest link in the chain. If one party does not manage cybersecurity adequately, the effects can extend to others as well.”
Enerim is developing its information security management system in line with the international ISO 27001 standard. The company has also achieved exceptionally high scores in independent cyber maturity assessments.
Holsti says the goal is both to maintain a high level of cybersecurity and to keep strengthening it as the operating environment evolves.
Another tangible security advantage is that Enerim’s critical services are delivered from data centres in Finland. Holsti sees this as a clear strength in the current geopolitical environment.
However, Enerim’s ambitions extend beyond strengthening its own cybersecurity.
“In the closely networked energy sector, the capabilities of customers and partners also affect the security of the whole. That is why we want to make proven operating practices available to our customers.”
Holsti notes that energy companies do not all have the same resources to invest in cybersecurity. In smaller organisations in particular, cybersecurity may be just one responsibility among many. In these cases, building everything from scratch in-house is rarely the most sensible approach.
“It is worth adopting good practices from elsewhere. They can help an organisation take a much bigger leap forward than trying to learn everything on its own.”
Standing still is not an option
Holsti points out that energy companies are at very different stages of their cybersecurity journey. Some have highly advanced practices, while others are only beginning to develop them.
“The essential thing is to get started and develop operations systematically,” he says.
Enerim aims to help customers identify areas for improvement, adopt proven practices and put their preparedness to the test. The objective is to make cybersecurity a cohesive, continuously evolving discipline rather than a series of isolated measures.
“Even small steps can set an organisation on the path towards better cybersecurity. Standing still is not an option.”