Public feedback IDs challenges in securing critical infrastructure

Comments on the challenges of protecting the nation’s critical infrastructure have identified a handful of top-of-mind issues for the more than 200 people and organizations who responded to a formal request for information.

The National Institute of Standards and Technology has released an initial analysis of 243 responses to the Feb. 26 RFI. The analysis will form the basis for an upcoming workshop at Carnegie Mellon University in Pittsburgh as NIST moves forward on creating a cybersecurity framework for essential energy, utility and communications systems.

NIST was given the job under an executive order in which the president seeks to fill the void lefty by Congress’s failure to pass cybersecurity legislation. The order calls for voluntary information-sharing programs for private-sector operators with the military and intelligence communities and with the Homeland Security Department. At the same time, NIST will develop a framework to reduce cyber risks to infrastructure, consisting of voluntary standards, methodologies, procedures and processes for cybersecurity. It is intended to be a “prioritized, flexible, repeatable, performance-based and cost-effective approach,” that is technology neutral and developed with industry input.

An initial framework is due in October, with the final product delivered in February.

Comments in the RFI responses were normalized and categorized using specific terms or phrases that identified key concerns. “The resulting categorization was then used to identify commonalities and recurring themes,” analysts wrote in their report.

Risk-based approaches, a better understanding of the threat environment and the need to adopt industry best practices were among the points most commonly contributed.

Recurring themes were grouped into three categories: Principles that must be included in the framework; common points or practices that have wide applicability across sectors; and gaps where insufficient information has been received to meet goals.

Common themes identified in these categories were:

Framework principles: Characteristics and considerations the framework must encompass.

• Encourage the use of risk-based approaches rather than compliance-based approaches. (Included in 81 percent of responses)
• Consider the impact on global, international operations. (65 percent)
• Apply across multiple sectors and across the diverse group of stakeholders. (36 percent)
• Leverage existing risk management approaches, standards and best practices. Owners/operators should not have to manage overlapping or duplicative approaches, dual standards and conflicting requirements. (33 percent)

Common points: Practices identified as having wide utility and adoption.

• Understanding the threat environment: Improved understanding, knowledge and information sharing of threats and the constantly evolving threat landscape and its impact on critical infrastructure. (75 percent of responses)
• Cyber risk in the context of business risk: A cohesive risk management process that addresses cyber risk in conjunction with other types of risk at the organizational level and mission/business level. (69 percent)
• Senior management engagement: Senior management buy-in and accountability for cybersecurity. (67 percent)
• Cybersecurity workforce: A skilled cybersecurity workforce is important to meet the needs of critical infrastructure cybersecurity. (62 percent)
• Separation of business systems and operational systems: Business systems and operational systems have traditionally been different. But they can now be core-connected, share the same platforms and have integrated functionality. The practice of separating these systems was the single most referenced best practice, often referred to as critical. (60 percent)
• Incident response: The capability to continue or resume operations in the event of disruption of normal operation. This entails the preparation, testing and maintenance of specific policies and procedures to enable the organization to recover operational status after a disruption. (28 percent)
• Baseline security. The core cybersecurity practices that any organization should fulfill; good cyber hygiene. (21 percent)
• Models for levels of maturity: Maturity relates to the degree of formality and optimization of processes -- from ad hoc practices, to formally defined steps, to managed result metrics, to active optimization of the processes. (20 percent)

Initial Gaps: For the purposes of RFI input analysis, initial gaps are those areas where RFI responses were not sufficient to meet the goal of the executive order.

• Industry best practices: Activities performed by organizations that allow them to achieve repeatable, reliable and scalable service. These practices range from low-level implementation details to high-level risk management techniques. (65 percent of responses)
• Metrics: Performance-related data used to monitor and measure the accomplishment of goals and objectives by quantifying the implementation, efficiency, and effectiveness of security measures. (59 percent)
• Dependencies: Operations have become increasingly dependent on a variety of entities and critical functions rely on lengthening supply chains. (57 percent)
• Use of tools: Tools allow the organization to attain a higher level of situational awareness with respect to cyber risk, enabling greater visualization, compliance checking, continuous monitoring or asset management. Tools can be processes or personnel resources as well as products. (56 percent)
• Privacy and civil liberties: The ability of individuals to avoid harmful consequences to themselves arising from the use or exposure of information about themselves; civil rights and freedoms that provide an individual specific rights. (52 percent)
• Resiliency: The ability to sustain an attack and continue to deliver critical services with a minimum of downtime. This can include self-healing networks, fail-overs, hot swaps, etc. (46 percent)
• Nomenclature: As the framework is developed, it is important that terms and concepts are fully defined such that they are clear and consistent. The cyber risk space has a wealth of terms and concepts, with many terms mapping to many concepts. (27 percent).