DATASHEET

Energy Industry Brief

Financially Motivated Cybercriminals Threaten Energy Providers

64%

56%

54%

of energy industry leaders saythat sophisticated cyberattacks
are a top challenge1

report at least one shutdown or
operational data loss per year2

expect an attack on
critical infrastructure in
the next 12 months3

Cybersecurity is Crucial as Energy Providers Digitize
The energy industry is powered by operational technology (OT)systems, the highly specialized hardware and software used togenerate, transmit, and distribute power. Historically, OT and IT
systems were siloed from each other, which shielded OT systems
from cyberattacks. However, as the utility industry digitallytransforms, OT systems are being connected with IT systems,
enabling energy providers to replace centralized power generation
with distributed systems of natural gas and renewable energy.
Digitization makes energy delivery more efficient, benefiting
both utility customers and the environment, but it also enables
cybercriminals to breach OT systems simply by compromising a
set of employee login credentials. Cyberattacks on OT systems candamage energy grid assets, causing power outages, damaging theenvironment, and putting human health and life at risk.

Administration may be delegated according to department or byteam leader, and folders and records can be securely shared andrevoked. If an administrator or employee leaves the company, theirvault can be automatically locked and securely transferred. Accesslogs to Keeper vaults can be audited for compliance or forensics.

Secure More than Just Passwords with Keeper Secure File
Storage
In addition to securing employee passwords, Keeper helps
organizations prevent theft of digital IP and other sensitive databy enabling them to store sensitive files, documents, digital
certificates, private keys, images, and videos in a highly secure,encrypted digital vault. Employees can securely share files withcolleagues with confidence, knowing that only the intended
recipients can access the shared files.

In addition to nation-state cybercriminals who are seeking todamage utility grids, the energy industry is a prime target for
financially motivated ransomware attacks, as utility providers havean incentive to pay up quickly. In October 2020, multinationalenergy company Enel Group was hit by a ransomware attack4 forthe second time in the calendar year; attackers demanded a $14
million ransom payment to release decryption keys.

Keeper uses PBKDF2 to derive authentication keys based on theuser’s Master Password, then generates individual record-level
AES-256 encryption keys locally on the device to encrypt eachstored file. Keeper’s cloud only holds the encrypted ciphertext ofeach file. Sharing between users is performed using PKI to ensurethat only the recipient of a shared file can decrypt it. Keeper’s
zero-knowledge encryption methods ensure that only the user canaccess and decrypt their stored files.

The COVID-19 pandemic has left energy providers especiallyvulnerable. With many employees working remotely,
cybercriminals can take advantage of insufficiently secured remote
workforces and undermanned facilities.

Defend Against Third-Party Vendor Breaches with
BreachWatchTM

Keeper Helps Energy Providers Secure Critical
Infrastructure

Even if your password security is solid, your organization could
be compromised through one of your vendors. With remote
workforces having rapidly expanded, cybercriminals are taking
advantage of the myriad of SaaS solutions that businesses are
deploying to enable their remote workforces.

Keeper enables energy providers to protect their OT systems
by securing the most vulnerable part of their IT networks, theiremployees’ passwords. Every employee is provided with asecure digital vault. A security dashboard in the Admin Console
provides an overview of weak passwords, password reuse, and 2FA
enforcement, along with role-based access controls (RBAC) toenforce least privilege policies.

© 2021 Keeper Security, Inc.

DATASHEET

Energy Industry Brief

Data breach victims are typically the last ones to know they’vebeen compromised. It can take a breached organization months,
even years to detect a breach, but cybercriminals don’t wait. Whenthey steal login credentials, they put them to use very quickly,
either by launching their own cyberattacks or by putting them up
for sale on the Dark Web - the part of the World Wide Web that is
only accessible by means of special software.
Keeper’s BreachWatch for business protects your organization
against third-party vendor breaches. BreachWatch for businessdoesn’t depend on public breach notifications. It scans Dark Web
forums and notifies organizations in real-time if any employee
passwords have been compromised. This allows IT administrators
to force password resets right away, minimizing the risk ofcybercriminals using them to breach company systems.

Simplify Compliance Enforcement & Reporting
Keeper simplifies compliance monitoring and reporting with robustinternal controls through delegated administration, enforcement
policies, event tracking, monitoring, and reporting, as well as
customizable audit logs and event reporting.

Email Auto-Provisioning

Microsoft Active Directory Synchronization
Keeper® AD Bridge synchronizes to Microsoft Active Directory orOpenLDAP. This enables rapid user provisioning and automaticallyadds Nodes (organizational units), Users, Roles, and Teams.
Keeper enables RBAC and the ability to track roles when employee
positions or job duties change. This includes automatically locking
vaults when employees depart the company.

About Keeper Security, Inc.
Keeper Security, Inc. (Keeper) is the highly-rated and patented
cybersecurity platform for preventing password-related data
breaches and cyberthreats. Keeper’s zero-knowledge security andencryption software is trusted by millions of people and thousandsof businesses across the globe to mitigate the risk of cybertheft,boost employee productivity and meet compliance standards. In
2020, Keeper was named PCMag’s Best Password Manager of theYear & Editors’ Choice for the third time. Keeper has also been
named PCWorld’s Editors’ Choice and is the winner of four G2Best Software Awards and the InfoSec Award for Best Product inPassword Management for SMB Cybersecurity. Keeper is SOC-2
and ISO 27001 Certified and is also listed for use by the U.S. federal
government through the System for Award Management (SAM).

Easily and quickly provision Keeper vaults to tens or thousandsof users, with a domain match on email addresses. With minimum
administration, large-scale deployment can be accomplished using
an existing email channel or portal.

Flexible Provisioning
Keeper supports the ability to seamlessly provision users andteams from Microsoft Azure AD or other identity platforms using
the SCIM protocol. Keeper also supports API-based, commandline provisioning through the use of Keeper® Commander SDK.
The Keeper Commander SDK is open-source Python code that isavailable for download from Keeper’s Github repository.

Keeper Third-Party Attestations and Certifications

1Siemens

2

Ibid

3

Ibid

4

Information Security Buzz

keepersecurity.com | sales@keepersecurity.com© 2021 Keeper Security, Inc.