Protecting critical infrastructure: All hands on deck
Connecting state and local government leaders
Government agencies have the resources they need to improve cybersecurity, but they must work together cohesively to overcome communication and policy barriers to take advantage of those resources.
Water. Electricity. Gas. Internet and cellular signals. These are just part of the basic infrastructure that helps communities function.
While most of these critical infrastructure services have been available for decades, they certainly were not the targets of malicious cyberattacks they have become today. The “could happen in the future” mentality about attacks on our infrastructure has turned into a “which one is next” and a “not if, but when” crisis across the country.
As the economy has shifted to running mostly online, it has become dependent on the internet, which has directly led to a significant increase in vulnerabilities. Attacks are no longer just impacting businesses and governments but are disrupting citizens’ day-to-day lives and how society functions. Plus, the motives of hackers have evolved, as they look for opportunities to create chaos that creates an environment they can take advantage of.
The attacks have become so frequent and widespread that it’s clear we’re entering a new era of warfare. A “digital Pearl Harbor” is becoming a constant threat as the nation’s adversaries look to disrupt critical infrastructure. Any major attack on utilities, supply chains or transportation systems will accomplish that.
A recent Senate report found several large federal agencies have failed to implement sufficient data security protocols to date. Although these findings are alarming, they’re also a wake-up call for lawmakers to pursue legislation that would formalize and unify cybersecurity measures across federal infrastructure. Without collective agreement about proper cyber defense protocols at the highest levels of government, it becomes exponentially more challenging to implement informed cyber policy across the entities those agencies oversee (e.g., schools, banks, hospitals, etc.). Without proper policy, the U.S. continues to leave itself open to foreign adversaries, resulting in continued attacks on critical infrastructure and health care systems and supply chain exploits like the SolarWinds attack.
Words into action
Cyber defense moved significantly forward on July 28, when President Joe Biden signed a national security memorandum, “Improving Cybersecurity for Critical Infrastructure Control Systems.” The NSM essentially implements long overdue efforts to meet the threats our country faces.
In short, the NSM directs the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency, the National Institute of Standards and Technology and other agencies “to develop cybersecurity performance goals for critical infrastructure” that will help companies that provide essential services like power, water, and transportation strengthen their cybersecurity.
The NSM calls for federal agencies to present a united front led by DHS with CISA spearheading proactive cyber strategy.
That strategy should be backed by legislation and actively enforced rather than positioned as guidance. Reported security oversights and vulnerabilities must also be immediately addressed through better interagency information sharing. Back-end IT systems should be updated (in accordance with NIST guidelines) to phase out legacy components and enable regular patching.
Finally, deeper implementation of zero-trust protocols outlined by Biden’s recent executive order on Improving the Nation’s Cybersecurity will help federal agencies stay better insulated from unauthorized access of sensitive data and insider threats.
Government has the resources it needs to improve its cybersecurity posture, but it must work cohesively – and together – to overcome communication and policy barriers to take advantage of those resources. The federal government must also push for more cyber-trained resources, like CISOs, for government and private industries.
While the NSM and the president’s EO have kick-started a focused and aggressive effort to address significant cybersecurity threats, securing critical infrastructure requires a whole-of-nation effort. The country is still far from implementing what is required to protect its commercial and private sectors, but together I believe we can get there.
NEXT STORY: Taking meaningful steps toward stronger security