Ransomware Resilience for a Gas and Electric Distribution Utility
Identity, outage management and billing rebuilt from clean infrastructure in 19 hours during a full-scale exercise.
Client name withheld by agreement- Client
- Gas and electric distribution utility, 1.1 million customers
- Region
- Albany, New York
- Year
- 2024
- Duration
- 16 weeks
- Scope
- 3 Active Directory forests · outage management and billing · gas control SCADA
- Practice
- Offensive Security & Resilience
The challenge
What was at stake.
A gas and electric distribution utility serves 1.1 million customers across upstate New York. Its outage management system, customer billing platform and gas control operations all authenticated against three Active Directory forests that had not been redesigned since a merger.
Ransomware operators usually take Active Directory first. The utility had sound server backups but no tested way to rebuild identity, and the state regulator expected a credible account of how outage restoration would continue during a cyber incident.
What we did
The approach, step by step.
- 01
Identity treated as tier zero
We assessed all three forests for attack paths to domain control, removed 214 excess privileged accounts and moved administration to dedicated, hardened workstations.
- 02
Forest recovery engineered
Immutable, isolated backups of domain controllers and a scripted forest recovery procedure were built and tested in a clean-room network.
- 03
Recovery order agreed with operations
Gas control, electric operations, customer service and finance agreed which systems return first, with outage management at the top during storm season.
- 04
Full-scale exercise
A timed exercise rebuilt identity, outage management and billing on clean infrastructure, while gas control ran on its local systems as planned.
- 05
Regulator and public notices rehearsed
Notification templates for state regulators, federal agencies and customers were drafted, approved and exercised with the communications team.
Outcomes
What changed, in numbers.
- 19 hrs
- to restore identity, outage management and billing
- 214
- excess privileged accounts removed
- 3
- Active Directory forests with tested recovery
- 0
- impact on gas or electric operations during testing
Our storm plans assumed the computers worked. Now we have a plan for when they do not, and we have timed it.
Services delivered
Related engagements
More work in Offensive Security & Resilience.
-
Edison, New Jersey · 6 weeks
Offensive Security & Resilience · 2025Online Ordering and Pickup Penetration Test for a Regional Grocery ChainA flaw that exposed any shopper’s order history and saved address, closed before the holiday ordering peak.
-
Stamford, Connecticut · 28 weeks
Offensive Security & Resilience · 2026 · OngoingUnified Controls in ServiceNow IRM for a Payroll and Earned-Wage Platform537 requirements reduced to 126 controls in ServiceNow IRM, with 61% of control tests now running automatically.
-
Hartford, Connecticut · 13 weeks
Offensive Security & Resilience · 2024Cyber Continuity and Enterprise Risk for a Mutual Property InsurerClaims kept moving through a simulated ransomware attack during a hurricane surge, and cyber risk now reports to the board against a stated appetite.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.