Resilience isn’t possible when attacks cause physical damage to the grid

Claim: They are harder to damage through cyberattack than they look, given the growing (albeit incomplete) attention to cybersecurity; and experience shows that people compensate for damage and quickly repair or rebuild.

My response: This is true when there is no equipment damage such as occurred with the 2003 Northeast Outage. However, this is not true when long-lead equipment such as transformers, generators, or large motors are damaged or destroyed. I also question whether there actually is growing concern about control system (not OT network) cyber security as can been from the responses to the DOE Request for Information with respect to the Presidential Executive Order 13920.

Only nation states are realistically capable of inducing a cyber catastrophe, and they’re not likely to do so

Claim: According to Jim, non-state actors and most states lack the capability to launch attacks that cause physical damage at any level, much less a catastrophe.

My response: That may have been true ten years ago, it is certainly not true today. I wanted to have Dillon Beresford speak at my Conference about 10 years ago as he was able to hack a Siemens PLC in a similar manner as Stuxnet. The key point was 2 months earlier, he had never worked on a PLC. In fact, DHS kept him from speaking at a local conference because of his findings. Blackhat and Defcon conferences have multiple tracks and demonstrations of hacking OT networks as do many other conferences.