The next frontier: Digital attacks on critical infrastructure

One of the oldest strategies in both modern and ancient warfare is to strike the enemy where the most damage can be done. The notion of disabling normal operations and critical infrastructure not only generates fear, confusion and turmoil, but it also cripples the enemy in ways that make mounting a counterattack difficult if not impossible. In World War II, for example, the Allies routinely bombed German transport hubs. Even today, during a time of relative peace, targets are consistently identified, updated and confirmed so that if they ever need to be exploited, they can be.

On July 18, 2018, Director of National Intelligence Dan Coats testified that a new kind of target, namely digital infrastructure, was being put squarely in the attack crosshairs by enemies on every front. He likened the “chatter” that the intelligence community had picked up to that preceding Sept. 11, 2001, when he said that the “lights are once again blinking red.” But this threat is not what we have historically guarded against, and the impact can be significantly more damaging than what we may expect or have prepared for.

Technology is all around us. Quite literally, from the time we wake up in the morning until we go to sleep, we rely on the technology and digital infrastructure that is directly woven into the fabric of our everyday lives. More than just smartphones or PCs, operations technology (OT) is the infrastructure that purifies water, supplies power, heat and cooling, runs the supply chain that supports consumers -- and even powers the advanced technologies that keep us safe from our physical attacks.

As a point of reference, in 2003 more than 55 million people on the Eastern Seaboard were plunged into darkness due to a cascading power failure. Most had their power restored in two days. Now imagine double that number -- 100 million people without power for several months due to a carefully architected digital attack. We are truly in an era where a line of code can cause more damage than any bomb could. This is not science fiction. It is reality.

OT was introduced in the 1950s, and it contains specialized computers such as programmable logic controllers or distributed control systems that run the industrial processes that control our world. It is used to generate and distribute power, manufacture food, drugs and automobiles, and much more. OT is clearly not new; however, the way it operates has changed.

The IT infrastructure for PCs and phones, for example, is open, accessible and constantly changing to keep up with emerging trends and threats. OT, on the other hand, was always isolated. Few people had access to it, and the notion was to “set it and forget it.” It was not uncommon for these isolated OT systems to run for a decade or two, without any disturbances or changes.

With the advent and adoption of the internet of things, more OT systems have become connected to each other and the internet. As a result, they are no longer isolated and are vulnerable to many of the same security threats as IT systems.

In addition, many organizations both in the public and private sector have purposefully created initiatives to converge their IT and OT systems to potentially reap the substantial efficiency and cost saving benefits. These initiatives however, have opened up a Pandora’s box of security issues that can directly impact the once-isolated OT systems.

Over the past 36-48 months, there have been countless reports of both attempted and successful digital attacks on critical infrastructure, both in the government and private sector. While there have been only isolated cases of targeted systems being impacted, experts believe that nation-states and rogue factions alike have gained “red button” functionality in these systems, which can literally be called upon at a moment’s notice to cause damage. The targets have been identified, acquired and confirmed.

To ensure that the weaponization of critical infrastructure does not become a reality, we must implement the same approach used to protect IT infrastructure to OT systems. While the tools must be architected for an OT environment, many of the concepts are the same. They include:

• Maintaining an up-to-date inventory of assets.
• Patching systems when vulnerabilities are discovered.
• Applying a strong access-control standard so that insiders such as employees and contractors get access only to the assets required for their job function.
• Deploying a strong, multi-disciplinary threat control system consisting of both signature and anomaly detection.
• Performing regular device checks on OT assets to ensure they are running as expected and have not been compromised.

Cooperation and information sharing between teams responsible for IT and OT security, as well as community sharing of threat intelligence and countermeasures will help ensure that industrial systems used in critical infrastructure cannot be weaponized and used against us.