More than a decade ago, the attack on Ukraine’s energy grid felt like a surprising watershed, proof that cyber operators could reach through keyboards to shut off the lights. This marked a shift into a new phase of geopolitical conflict: one defined by cyber-attacks manifesting physical world effects, particularly against critical infrastructure. Since 2015, there have been ransomware attacks against major oil systems, healthcare systems, and water systems in the United States and across the globe. Cyber criminals are conducting reconnaissance and pre-positioning for future operations, and are coordinating actions on a larger scale, like the recent cyber-attack against Poland’s energy sector. 

Today, the threat to critical infrastructure, particularly in the United States, remains a top priority for industry and government. Adversaries are more patient, better resourced, and increasingly exploring how to enhance their attacks using advanced AI capabilities. Many critical infrastructure operators also are working to integrate AI technologies into their cyber defense plans and operations. The race between defenders and attackers is on and it is unclear what side will win. 

One key to successfully protecting the nation’s critical infrastructure is to establish and sustain intra-sector, inter-sector, and public-private partnerships. These distinct partnership types can help organizations operating and supporting critical infrastructure effectively and efficiently prepare for, respond to, and recover from cyber-attacks.

Intra-sector partnerships are perhaps the most efficient and effective approaches given an industry’s relatively shared threat landscape, security tool usage, and operational risks. When organizations within a critical sector share threat intelligence on potential or actual cyber-attacks, the entire industry can strengthen resilience to prevent threat actors from successfully scaling their attacks. Within the electric power sector, the Cyber Mutual Assistance (CMA) Program serves as a decades-long proven model of collective defense. Following the 2015 attack on Ukraine’s electric grid, a group of CEOs within the Electricity Subsector Coordinating Council (ESCC) convened to discuss ways to prevent a similar outage, and CMA was born. Today, CMA is a group of security experts representing more than 210 electric and natural gas entities that stand ready to provide mutual assistance in the event of a significant cyber incident. This kind of support is vital in a shifting threat landscape where it is increasingly difficult for a single organization to defend itself against a growing number of malicious actors. 

In addition to mutual assistance, it’s important for organizations within a sector to participate in joint exercises that challenge assumptions, strengthen relationships, and build resilience. For example, the Electricity Information Sharing and Analysis Center hosted its eighth biennial GridEx exercise. This cyber and physical security exercise convened thousands of experts from across the electric power industry and government partners to assess and improve their responses to simulated attacks on the energy grid. GridEx helps to inform organizational planning and budget priorities that can strengthen the overall resilience of the U.S. energy grid.

Inter-sector partnerships are a natural expansion from those within an industry. No critical infrastructure sector has a monopoly on security threats or the experts to help defend against them, and many facets of U.S. critical infrastructure are interconnected and interdependent. As Volt and Salt Typhoon revealed, threat actors aim to burrow into multiple critical sectors with the goal of having the ability to disrupt U.S. economic and national security. Therefore, it’s imperative to work across sectors to better understand how adversaries are targeting critical infrastructure and to better strengthen it. 

Another recent example is the 2024 CrowdStrike outage that made computers inoperable in organizations across the transportation, financial, and healthcare sectors. 

Finally, critical industries and government must renew their commitment to public-private partnerships. The Department of Homeland Security Cybersecurity and Infrastructure Security Agency launched the Joint Cyber Defense Collaborative in 2021 to unify public and private sector cyber defenses through real-time, bi-directional intelligence sharing operational planning. Two years later, the Department of Energy piloted the Energy Threat Analysis Center (ETAC) to fuse industry data with government intelligence so cyber defenders can identify, analyze, and mitigate threats together. ETAC experts from public power utilities, electric cooperatives, investor-owned electric companies, and oil and natural gas entities analyze threat intelligence in real time, assess potential impacts to the energy sector, and develop risk mitigations that are broadly shared by Information Sharing and Analysis Centers to energy providers across the country. These examples of public-private partnerships leading to operational collaboration can be extrapolated across other critical sectors.

America’s adversaries are constantly enhancing their cyber-attacks and increasingly looking for ways to compromise critical infrastructure. We must continue to meet these challenges head on by leveraging intra-sector, inter-sector, and public-private partnerships. Cyber resilience is the goal; partnership is how we achieve it.
 

In October, Jackson State University in Mississippi received a $2-million grant from the Entergy Charitable Foundation to establish the Critical Power Grid Network Security Lab—an innovation and skills development hub that will help train the skilled cybersecurity workforce that electric companies will depend on in an increasingly digital economy.

With cybersecurity threats becoming more advanced and increasingly threatening America’s critical energy infrastructure, the new program will give students real-world experience and prepare them for careers in energy security.

“At Entergy, we believe that one of our many strengths in serving our customers is the diversity of our workforce,” Entergy Chair and CEO Drew Marsh said of his company’s work with one of the largest Historically Black Colleges and Universities (HBCUs) in the United States. “By investing in education and fostering inclusion, we are not just building a diverse workforce; we are investing in the heart of our communities where we live, work, and serve.”

Jackson State University is updating its curriculum to help prepare students for roles that are in high demand throughout the industry. The new program will focus specifically on energy security, including for the nuclear energy and natural gas sectors.

“Looking ahead, this lab will not only benefit Jackson State University and our students, it will also play a critical role in shaping the broader energy landscape,” University President Dr. Marcus Thompson said in a statement.

The grant is Entergy’s latest effort to support HBCUs throughout the company’s service territory in Arkansas, Louisiana, Mississippi, and Texas. In July, Entergy announced a 10-year, $20-million commitment to support HBCUs, building on the $7.4 million that it already has invested into HBCUs since 2018. The commitment supports improvements to facilities and curriculums, internship and research opportunities, mentorship programs, and technology upgrades.

Entergy’s pledge also will support academic scholarships, facility grants and endowments, and workforce development and career readiness programs, opening pathways to employment at Entergy for high-performing HBCU students.

“As an energy industry leader, it’s important that we help develop future generations of the U.S. energy workforce by strengthening awareness and promoting the advantages of careers in our field,” Marsh said.

The $20-million initiative will include the awarding of $5,000 annual scholarships to 20 high-achieving HBCU students within Entergy’s service territory, the establishment of a competitive grant program to support research and facility improvements at HBCUs, and the support of workforce development initiatives, including the creation of 10 annual internships. Over the summer, Marsh joined EEI and the American Association of Blacks in Energy (AABE) for the second-annual Executive Leadership Development Summit in Massachusetts.

The event was held in August during a series of multi-sector and multi-disciplinary leadership meetings on Martha’s Vineyard, part of the Underground Railroad in the late-1700s and 1800s and historically considered a popular destination for Black middle-class and upper-middle-class families. It brought together civic leaders, EEI member company executives, leaders from HBCUs, and other stakeholders to discuss the steps needed to develop Black industry leaders and to help foster a more diverse and inclusive workforce.