A Fundamental Change In Mindset Is Needed To Protect Our Critical Infrastructure

 

As we enter now into mid-January, one could say we are now deep rooted in the New Year.  This of course is going to be one interesting and crazy year, especially with the Presidential Elections that will be coming up in November.  But one thing that won’t rest is the Cyber threat landscape.  One particular area of trouble is that of the Critical Infrastructure of the United States.

This includes our water supply, food distribution system, the national power grid, nuclear facilities, etc.  One of the main reasons why they have become such a huge target is that the technology they use is totally outdated.  For example, they use hardware and software that was developed back in the 1970s.  But back then, nobody gave Cybersecurity a concern, the main fear was about Physical Access Entry.

One might say why don’t we simply rip out the old systems and put new ones it?  Well, this is theoretically possible, technically it is infeasible.  This is for two reasons:  1) There is too much interconnectivity now that is taking place between the hardware and software (brought on pretty much by the IoT); and 2) Many of the suppliers that built the stuff way back then are no longer in business.  It would take literally forever to get new parts made again.

But another area that can be changed is in our mindset.  Just like the digital threat variants, we have an image of what is perceived to be dangerous.  While they are, there are other ways we to rethink this approach, especially when it comes to safeguarding our Critical Infrastructure.

Here is what can change:

1)     The Nation State Actors are not the only ones:

When we hear this term, we think about Russia, China, and North Korea.  And don’t forget Iran.  While these countries pose a grave threat in terms of Cybersecurity to the United States, don’t discount home grown terrorism either.  We never thought that this could happen, until Oklahoma City happened.  But as mentioned before, given the current climate in this country, this is now a huge threat, which should not be overlooked.

2)     Just don’t look at the devices:

When we think about the lines of defenses, we also often conjure up the image of devices of all kinds, both physical and virtual.  But don’t get blindsided into this way of thinking only.  Think also about the access to these devices.  For example, what if your employee loses their smartphone, and it falls into the wrong hands?  Are the right access controls in place to make sure that no data can be exfiltrated from it?  This is where the area of Identity and Access Management (IAM) will play a crucial role.

3)     Break it down to the basics:

 

Protecting Critical Infrastructure can be a complex proposition, that’s why people are too slow to implement any kinds of safeguards.  So in this regard, bring it down to the basics.  Simply start off with good Cyber Hygiene.  Make sure you have Security Awareness Training programs, and make sure that your employees practice what you preach to them.  Also launch mock drills, such as mock Phishing attacks to see if they are really applying what you have trained them on.  Also, make sure that you have good Incident Response (IR), Disaster Recovery (DR), and Business Continuity (BC) plans in place.  Make sure you practice them as well, and update your relevant documents with the lessons that have been learned.

My Thoughts On This:

Our Critical Infrastructure will always be at risk, just like anything else in life.  But the key here is in learning how to mitigate that risk from actually being exploited.  Perhaps by changing our mindset into a different direction will add more power to it.