Critical Infrastructure: A Flashing Beacon For Cybercrime

In May of 2021, Colonial Pipeline, the largest pipeline system for refined oil products in the US, suffered a damaging cyberattack. The breach, a result of a vulnerable VPN password, caused the company to close down operations for a number of days, resulting in oil shortages on the East Coast. This is just one example of how devastating an attack on a critical industry can be.  
 
The UK government states there are thirteen sectors that come under the umbrella term ‘critical infrastructure’ including, chemicals, civil nuclear, communications, defense, emergency services, energy, finance, food, government, health, space, transportation, and water. All of these, which provide services that are essential to the day-to-day functioning of society, are hives of the most sensitive and confidential data that threat actors can easily be monetised on the Dark Web, driving further cybercrime and disruption.  
 
Unfortunately, the potential for widespread disruption has not gone unnoticed by cybercriminals. In fact, the US  Cybersecurity and Infrastructure Security Agency has urged the UK to act rapidly, warning that its government could be the victim of a 9/11 style cyberattack. This year also saw cybersecurity authorities in Australia, Canada, New Zealand, US and UK pleading for critical infrastructure defenders to prepare for an escalation in cyberattacks after the war between Russia and Ukraine.  
 
This increased risk has already been felt across the world with various national and public bodies being targeted, from governments in Cuba and Peru to water companies such as South Staffordshire Water as well as Denmark’s largest train operator and the NHS, which was impacted by a supply chain attack. With heightened political tensions across the globe, the potential for another attack on our critical infrastructure is not just concerning but highly likely. So, let’s take a look at what the current threat landscape looks like and how companies, as well as government agencies, can better protect themselves.  
 
Why Are Critical Industries More At Risk? 

This focus on critical infrastructure is intentional. Cybercriminals are fully aware of the impact that any disruption has on vital services, not just financially but also on public confidence. For example, in utilities, you cannot expect people to be without electricity or water, which means companies are more likely to pay in the event of ransomware. Hackers are also very observant and will strike during periods of unrest, for example using the ongoing energy crisis as an entry point for phishing or man-in-the-middle attacks.  
 
Another common risk factor among critical infrastructure organizations is that they all have a high level of interconnected legacy tech. This could include old devices that may not be used every day but are still active, or a machine that is critical to business processes but can only operate on older software that can’t be patched. Much of this legacy, although residing on our managed networks, does not sit within the ownership of our digital and security teams. It is true that some industries are more dependent than others, such as utilities, but everyone has their own battle to overcome.  
 
By not having a cohesive understanding of their technology estate, it makes it much harder for these industries to implement a holistic security strategy and also provides hackers with more ways to gain access to the wider network.  
 
Is Increased Connectivity The Problem? 

This problem has been exacerbated by the introduction of IoT devices which are incredibly complex to manage and are rarely built with security in mind. As companies collect more data and expand their network infrastructures, the more attractive they become to hackers and the harder it is to defend against threats.   
It’s vital that past experiences such as the Colonial Pipeline are not forgotten, but instead used to fuel next steps. While increased connectivity does widen the attack surface and make it more difficult to manage, there are technologies that help secure IoT devices against new threats and make this transition period smoother. 
 
It's important that we don’t stand in the way of technological progress. If we look at the transportation industry, when we board a plane, we have no idea whether a pilot is in control or if it is just on autopilot. But we still go on holiday and travel with confidence. It is possible to build the same level of trust when it comes to advances in driverless cars, despite their increased connectivity and reliance on IT. To get there, manufacturers need to be building security into these products. If things are designed with security in mind, they are less likely to get breached. This is a transferable message that needs to underpin every new decision, in every sector but especially critical infrastructure.  
 
Securing Our Future 

Many organizations are good with risk management but are missing the end-to-end cyber strategy that covers everything from employee engagement and BYOD security to firewall management and anti-malware protection.

Missing any one element can create vulnerabilities with damaging consequences. What is the takeaway from this? I think there are four key elements: 

1.    Communication is key:   You are only as strong as your weakest link so it’s crucial that there is an open dialogue within a company from the boardroom to the IT department. Any device that has access to the company network can allow hackers to gain access if it’s not properly managed. The problem is multiplied by the shift to home and hybrid working so organizations should be talking with employees and educating them on how to stay secure.   

2.    Visibility and segmentation:   It’s impossible to successfully secure a network without understanding the assets within it. Taking a full inventory, including cloud assets and data stores, will expose any weaknesses such as unpatched security updates or devices that have outdated firmware. Once you have mapped the network you can then implement strategies such as segmentation, which creates virtual internal barriers that stop hackers from moving laterally and creating widespread damage.  

3.    CISOs need to do their part:   The role of a CISO is to make sure that the board has greater understanding of the risks facing a business. Your job is to influence and make it clear to them in language they understand. This means spelling out the business consequences of weak security. There is a general lack of communication between CISOs and the wider business, and that needs to change in order to better secure our critical services.  

4.    Need for an overarching authority:   As we look at the challenges facing critical infrastructures, it's clear that companies in all sectors need to elevate their cybersecurity programs. But they cannot do it on their own. We need a unified regulatory body that can help these sectors implement standard practices. This will reduce disparities in cybersecurity spending, for example across energy and water.  
 
In the UK, our critical infrastructure is a bright flashing beacon attracting cybercriminals far and wide. The threat level continues to grow, and the consequences only become more severe. Now is the time to take action and prevention should be at the heart of every step they take to better secure themselves.  

Deryck Mitchelson is Field CISO EMEA at Check Point Software 

You Might Also Read:

Resilience Is Essential To Protecting Critical Infrastructure:

 

« US Bans Government Users From Using TikTok
IT Downtime Is Growing As Digital Transformation Speeds Up »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

WEBINAR: How To Build And Implement An Effective Endpoint Detection And Response Strategy

WEBINAR: How To Build And Implement An Effective Endpoint Detection And Response Strategy

Join this webinar to learn how the cloud threat landscape is evolving and organizations are deploying more advanced and capable security controls at scale.

eScan AV

eScan AV

eScan develops Information Security solutions that provide protection against current and evolving cyber threats.

K7 Computing

K7 Computing

K7 provides antivirus and internet security products for business and home users.

Global Forum on Cyber Expertise (GFCE)

Global Forum on Cyber Expertise (GFCE)

GFCE is a global platform for countries, international organizations and private companies to exchange best practices and expertise on cyber capacity building.

OSIRIS Lab - NYU Tandon

OSIRIS Lab - NYU Tandon

The Offensive Security, Incident Response & Internet Security Lab (OSIRIS) is a security research environment where students analyze and understand how attackers take advantage of real systems.

Right-Hand Cybersecurity

Right-Hand Cybersecurity

Right-Hand Cybersecurity empowers businesses to monitor, measure and mitigate employee induced cyber risks in real-time.

Cyphra

Cyphra

Cyphra’s team provide cyber security consulting, technical and managed services expertise and experience to support your organisation.

DeFY Security

DeFY Security

DeFY Security is a Cyber Security solutions provider with more than 20 years of experience securing financial institutions, healthcare, manufacturing and retail.

Anexinet

Anexinet

From full-stack engagement strategies and solutions to modern, secure infrastructure products and services, Anexinet focuses on technology-enabled business transformation that drives value.

Intrepid Solutions and Services

Intrepid Solutions and Services

Intrepid Solutions and Services provides technology solutions and professional services to key components of the intelligence and national security communities.

Matrium Technologies

Matrium Technologies

Matrium Technologies has been a leading provider of technology solutions since 1991, with a strong industry background in Network Testing, Network Visibility and Security.

ramsac

ramsac

ramsac provide secure, resilient IT management, cybersecurity, 24 hour support and IT strategy to businesses in London and the South East.

Virtual Technologies Group (VTG)

Virtual Technologies Group (VTG)

Virtual Technologies Group is a single source, IT product and services provider for SMBs and IT departments, delivering reliable, cost-efficient service, maintenance and support solutions.

Crayon

Crayon

Crayon is a customer-centric innovation and IT services company. We provide guidance on the best solutions for our clients’ business needs and budget with software, cloud, AI and big data.

European Data Protection Supervisor (EDPS)

European Data Protection Supervisor (EDPS)

The EDPS is the European Union’s independent data protection authority. We monitor and ensure the protection of personal data and privacy when EU institutions and bodies process personal information.

Commvault

Commvault

Commvault's data protection and information management solutions help companies protect, access and use all of their data, anywhere and anytime.

Smile Identity

Smile Identity

Smile Identity helps businesses confirm the true identity of their users in real-time using any smartphone or computer.