Enhancing Cybersecurity in Energy IT Infrastructure Through a Layered Defense Approach to Major Malware Threats

This study examines the cybersecurity vulnerabilities of energy IT infrastructure in the context of rapid digital transformation and network expansion. While these advancements have improved efficiency, they have also increased susceptibility to cyber threats, particularly from malware such as Industroyer, Triton, NotPetya, and BlackEnergy3. By analyzing these malware threats, this research identifies key weaknesses in energy systems and highlights the need for enhanced anomaly detection, network segmentation, and system integrity checks. To address these vulnerabilities, this study proposes a layered security architecture in which each layer—physical, control, network, application, and security—provides independent protection while integrating into a unified defense strategy. This research emphasizes the necessity of combining technical-, organizational-, and policy-based responses to bolster cybersecurity across all levels of energy infrastructure. Key recommendations include immediate vulnerability patching, improved international cooperation, stronger legal frameworks, enhanced cybersecurity education, and the establishment of a unified command structure. This study provides practical insights and strategies for strengthening the cybersecurity of energy systems through a comprehensive, integrated approach.