Critical Infrastructure Security
,
Governance & Risk Management
,
Operational Technology (OT)
OT Experts Advocate for Collaboration and “Adversary-Hostile” National Defenses
OT environments have long been bereft of their traditional shelter from cyberattacks made from hacker ignorance or disinterest. Industrial environments are forefronts for nation-state hacking, the risk heightened by global tensions and the convergence of operational technology with IT counterparts.
See Also: Beyond Replication & Versioning: Securing S3 Data in the Face of Advanced Ransomware Attacks
For those who can hear, alarms have been sounding loudly for some time. Yet advocacy for the basics – public-private partnerships and information sharing, tightly focused objectives that extend to the smallest operators and resilience planning – is still essential, said a clutch of government and industry leaders assembled Wednesday in New York for a panel hosted at the Global Cyber Innovation Summit.
It’s a set of principles and strategic objectives you might have heard about in 2022, 2020 or even 2015. Perhaps it’s overly familiar. On the panel were retired Army General Paul Nakasone, former director of the NSA, Chris Wray, former director of the FBI, William J. Fehrman, CEO of Director of American Electric Power and Rob Lee, CEO of Dragos.
For people on the front lines of OT security, the familiarity and repetition has a dark subtext: Too many people in boardrooms, on congressional committees and the public at large have still not grasped how devastating a successful attack on infrastructure could be. Nor how severely one could impact daily activities and comforts taken for granted.
“If you put our OT defenders up against the best adversaries, we win,” Lee told an invitation-only audience of security industry analysts, CISOs, security practitioners and journalists. “But we’re still involved in conversations about investment and moving toward execution.”
Unfortunately, the most effective means of persuasion could be the exact worst-case scenario that OT cyber defenders say they want to prevent: a low-risk, high-impact incident that cuts the lights or poisons the water.
The challenge of locking down the nation’s infrastructure is exacerbated by attackers who are deploying attacks that are reusable, scalable and capable of damaging a broad range of critical services.
Lee noted that in comparison to early OT attacks such as Stuxnet, which were highly specific to a target environment, today’s attack capabilities can be turned on many types of infrastructure systems, by far less sophisticated actors. (see: US Infrastructure Remains Vulnerable 15 Years After Stuxnet).
Reducing the nation’s risk depends on creating what Nakasone called a “toxic environment for attackers,” but also assuming that adversaries have gained access to critical systems and building out plans to expedite recovery and stay resilient.
Success Can Look Like Failure
Panelists emphasized that successful coordination between critical infrastructure operators, government agencies and security vendors can and does occur at enterprise level. Wray pointed to the 2021 Colonial Pipeline as an attack on a critical services provider that, in retrospect, demonstrates the resilience the nation needs when no system is totally secure and many are highly vulnerable (see: ISMG Editors’ Panel: Analysis of Colonial Pipeline Attack).
“Colonial had a relationship with the FBI, they knew the right people to call,” Wray said. Lee, whose company investigated the attack, said quick action kept the impacts on the IT side and prevented damage extending to mission-critical OT systems. The FBI was able to recover a significant portion of the ransom Colonial paid out. “Colonial Pipeline did [the response] right,” Wray said.
The problem, Wray said, is this type of quick response and tight partnership is common beyond the most sophisticated and well-resourced enterprises. Small companies control the majority of water treatment plants and electrical grids but often lack visibility into their environments. They operate recently connected machinery that attackers can exploit. In the event of a breach, they typically don’t know who to call for assistance. (see: Digitization Creates New OT Security Blind Spots).
An industrywide focus on advanced AI-enabled security and cutting-edge solutions can also obscure the fact that regional operators still need the basics. That’s true for the federal government too, Lee argued. Mission-sprawl has spread agencies like CISA too thin and drawn attention away from ongoing, fundamental security gaps, he said.
“Adversaries going after [the water sector] have basically just logged into systems. How about we get them a firewall first?” Lee asked.
Fehrman, the only panelists actively running an OT company, emphasized that operators need practical guidance from governments and regulators before threat intelligence. “We need information first, expeditiously and of quality. What you want me to do and how to do it is more important than the latest intelligence on the actors and methods.”
The other key task for operators, Fehrman said, is educating company boards about the reality of threats. This is another area where catching up is essential. Panelists agreed that many boards are still learning to distinguish between IT and OT risk and to take cyberthreats to critical systems as seriously as business leaders do.
Deterrence: Make Adversaries’ Operations Costs Prohibitively Expensive
Nakasone articulated the strategic goal rooted in the same cost-benefit analysis that draws adversaries to cybercrime. Bad actors with inexpensive root kits and ransomware-as-a-service obtain monetary or political profit from their activity. Defenders must find ways to reverse the equation and inflict pain by compromising bad actors’ crypto wallets and other tools criminals need to earn – and advertise the results.
“Hackers prize anonymity,” Wray said. “You out them in a very public way, they can’t get work. And then you’re having an impact. You go after their money launderers, they can’t service their business.” Ripping the veil of anonymity from criminals and even nation state hackers, Wray said, can tamp down the attacker talent pool. “There’s a talent gap for bad guys, too,” Wray said.
One Summit in an Ongoing Conversation
GCIS chairman and Allegis Cyber Capital founder Bob Ackerman (see: The AI Arms Race in Cybersecurity), in opening remarks, emphasized that the summit and other events are necessary to drive the short-term solutions and strategic initiatives needed to secure critical infrastructure and move the broader conversation beyond education and into action.
Thomas Fanning, former executive chairman and CEO of Southern Company and former chairman of the CISA advisory board, delivered the summit’s keynote address. Advocating for critical infrastructure security “is an act of patriotism,” Fanning said. “We are reimagining national security. I’m not focused on crime. I’m focused on an existential threat.”
One panel participant expressed growing frustration at the number of people in power who still do not take the threat seriously enough.
“We are not as secure as we were ten years ago,” he said. “The attackers are leveling up and we’re not moving fast enough.”