Protecting Canada’s energy infrastructure and supply chain from cyber attacks

An engineering professor from the University of Waterloo was awarded $1.2 million in federal funding to protect Canada’s critical energy infrastructure and energy sector supply chains from cyber threats.

Dr. Sebastian Fischmeister and his research team will use the grant to develop an enhanced cybersecurity system, using a checkpoint technology, that can identify the threats to the supply chains serving the country’s energy sector. The hardware and firmware integrity system examines and assesses critical energy infrastructure equipment and systems to identify the presence of fraudulent or counterfeit components. In addition, the engineers will search for new ways to guard this vital infrastructure from damaging interference.

Natural Resources Canada is leading federal involvement in the project, with funding from the Canadian Safety and Security Program, led by Defence Research and Development Canada (DRDC), the science and technology arm of the Department of National Defence (DND). The project also involves Palitronica Inc., a Kitchener-based startup that grew out of Dr. Fischmeister’s lab, the Real-time Embedded Software Group.

“Our goal is to be able to provide recommendations and guidance to the federal and provincial governments and Canadian companies on the best practices that ensure they’re only using safe and secure products in critical Canadian infrastructure,” said Dr. Fischmeister, a professor of electrical and computer engineering at Waterloo. “This research will compare methods, tools and techniques to mitigate threats to the supply chains when someone alters electronics by adding implants or sub-standard electronics.” Supply chain risks include the insertion of counterfeit elements and tampering, as well as malicious software and hardware.

The energy sector relies on extensive and complex global networks of suppliers to acquire the equipment, information, hardware, firmware and software to deliver energy supplies to their customers. Work designed to improve supply chain security is crucial because organizations can lose visibility into vendors’ and suppliers’ supply chain security practices as systems grow more complex. Meanwhile, the cyber threats and risks facing critical energy infrastructure and supply chains are constantly growing and evolving.

To address this complex environment, the team of 20 researchers from the University of Waterloo and Palitronica will investigate equipment used in the energy sector to better understand vulnerabilities that may emerge through supply chains. By creating a geographical map of the supply chain of an electrical device central to critical infrastructure, they will seek to demonstrate that supply chains are international, have many participants and therefore offer ample opportunities for interference from malicious actors.

The researchers will also compare the newest techniques for detecting cyber attacks on supply chains to identify their strengths and weaknesses. Finally, they will provide recommendations on ways to improve the cyber security of companies that rely on electronics with components sourced outside of their region.

The researchers are looking for three energy-sector partners that will allow them to conduct tests on their systems. In a controlled setting, they will tamper with a portion of a system then evaluate different methods used by the participants to detect the tampering. 

“Our unique approach can protect critical infrastructure and defence platforms in a way that existing cybersecurity approaches fail to do,” said Carlos Moreno, co-founder and chief technology officer at Palitronica. “We believe the commercial potential is tremendous. Canada and Canada’s federal government can greatly benefit from this research and the commercialization of the underlying technology.”

Ultimately, the researchers hope to transfer the developments in their lab to commercial settings. Palitronica is already partnering with companies to apply the new technologies in industry.

“Strengthening the cyber security of Canada’s energy sector supply chains is vital to the reliable and resilient operation of our energy systems, which are facing an increasingly complex cyber threat environment. Working in collaboration with universities and industry leaders, we are continuing to support the development of innovative technologies and approaches that build robust protections into the supply chain and protect our most critical systems against cyber threats,” said the Honourable Jonathan Wilkinson, Minister of Energy and Natural Resources. 

“Defence Research and Development Canada (DRDC)’s Centre for Security Science (CSS) is pleased to support the project Strengthening Cyber Security for the Supply Chain in the Energy Sector in collaboration with NRCan and University of Waterloo. As energy systems in Canada and around the world become more connected and intelligent, they are more vulnerable to cyber threats that can negatively impact the safety and security of Canadians. Through the Canadian Safety and Security Program, DRDC’s CSS supports the development of science and technology innovation that addresses Canada’s safety and security needs, including ensuring critical infrastructure is less vulnerable to threats,” said Christina Jutzi, Director General Policy and Advice, Defence Research and Development Canada.