Energy Sector Cybersecurity Services in Canada

Operational technology threats facing Canadian energy companies

• The Colonial Pipeline ransomware attack in May 2021, which caused the largest fuel pipeline disruption in US history and triggered fuel shortages across the eastern seaboard, established definitively that ransomware groups are willing to attack energy infrastructure and that OT environments are reachable even when operators believe they are isolated.
• Colonial's attackers entered through a legacy VPN account with a compromised password and no MFA.
• The company shut down pipeline operations proactively because it lacked confidence in the boundary between its IT and OT networks.
• Canadian energy operators drew two lessons from Colonial: IT/OT network segregation that exists on paper may not exist in practice, and the business decision to shut down operations in the face of IT uncertainty can itself cause the harm that attackers seek.
• Canadian energy infrastructure, electricity generation and transmission, natural gas pipelines, oil sands facilities, is designated as critical infrastructure under the federal government's National Strategy for Critical Infrastructure, with the Communications Security Establishment (CSE) and the Canadian Centre for Cyber Security (CCCS) providing threat intelligence and guidance to sector operators.
• The CCCS's Annual Cyber Threat Assessment has consistently identified the energy sector as a priority target for both financially motivated ransomware groups and nation-state actors seeking pre-positioning within critical infrastructure for potential future disruption.
• Pre-positioning, establishing persistent access without triggering an incident, for use later, is a especially insidious threat model because it may leave no immediately visible indicators of compromise.
• The industrial protocols underpinning most Canadian energy OT environments, Modbus, DNP3, IEC 61850, SCADA communication protocols, were designed in an era when operational networks were assumed to be physically isolated and accessible only to trusted technicians.
• They have minimal or no authentication, no encryption, and no built-in integrity verification.
• A packet sent on a Modbus network is executed because it arrives in the right format, not because the sender has proven its identity.
• These protocols cannot simply be replaced, replacing a substation's protection relay or a pipeline's RTU requires engineering validation, regulatory approval, and often years of planning.
• The practical defense is network architecture: strict zone segmentation, unidirectional data diodes for monitoring traffic, protocol-aware firewalls, and anomaly detection systems that baseline normal engineering traffic and alert on deviations.
• The persistent myth that OT environments are air-gapped from internet exposure is contradicted by the operational reality of modern energy management.
• Remote access for equipment vendors and OEM service technicians is nearly universal, it is how turbine manufacturers push firmware updates, how SCADA system vendors provide support, and how pipeline operators monitor remote compression stations.
• Every remote access path is a potential entry vector.
• Jump servers and remote desktop gateways introduced to manage vendor access are often underpatched, shared among multiple vendors, and logged inadequately.
• The CCCS has specifically flagged remote access to OT environments as the primary initial access vector in energy sector incidents, and has published guidance requiring MFA on all remote access paths, session recording, and vendor access reviews at defined intervals.

Who regulates what in Canadian energy