Case Study
Energy: SCADA Security in the Lab and in the Field
CloudCover’s work in the energy sector spans two engagements: a laboratory evaluation with Electric Power Research Institute (EPRI) researchers testing detection of attacks on grid control systems, and a production deployment protecting the network of a large U.S. oil and gas distribution and storage company.
Grid research lab: detecting Stuxnet
Challenge
EPRI researchers were concerned with detecting never-before-seen attacks against critical components of the electric power grid — specifically attacks delivered through Supervisory Control and Data Acquisition (SCADA) equipment. They wanted to know whether the infamous Stuxnet worm could be detected, and perhaps stopped, by network-level monitoring.
Approach
CloudCover installed the CC/B1 security appliance to monitor all internal SCADA network traffic in the researchers’ lab environment. The researchers then attacked the lab’s SCADA systems with a copy of the Stuxnet worm.
Outcome
Using deep packet inspection combined with signature-based detection and statistical analysis, the platform identified the worm’s traffic as malicious from its similarities to previously known viruses, worms, and malware — without a signature for the specific attack — and flagged it for blocking.
The researchers found the approach useful against other attack types as well: it demonstrated that unfamiliar attacks can be caught at the network level from their resemblance to known malicious behavior.
Oil and gas distribution network
Challenge
Following the Colonial Pipeline ransomware breach of 2021, a large U.S.-based energy distribution and storage company — hundreds of employees across multiple locations in the United States — engaged CloudCover to address its network security concerns.
Approach
CloudCover deployed the CC/B1 appliance to monitor the company’s network traffic. After a 72-hour period spent mapping the topology of the client’s network, the appliance was placed into full protection mode, with automated blocking of malicious traffic enabled.
Outcome
Early monitoring uncovered that attackers had infiltrated the network through the company’s VoIP phone system — a foothold that predated the engagement. The platform detected this unusual threat vector and automatically blocked the attacks.
The company’s network continues to see a high, sustained volume of security events. The platform continues to detect and automatically block attacks — including malware not matched by existing signatures — while logging every event for the company’s review.