Critical Infrastructure Security
,
Governance & Risk Management
,
Operational Technology (OT)
Critical Infrastructure on the Digital Front Lines
Rural America is a long way from Taiwan. But cyber power is no respecter of geography. Should China make good on its repeated threats to reunify the island by force, the utilities that provide water and power to small towns all over the United States may find themselves on the digital front lines of a 21st century superpower war.
See Also: From Ancient Myths to Modern Threats: Securing the Transition from Legacy to Leading Edge
Hackers linked to China have accessed the IT networks of hundreds of small and medium-sized U.S. water systems and other utilities with a view to sabotaging American water and power supplies in the event of a conflict, CBS reported this week, detailing a threat that U.S. officials warned of two and a half years ago.
The revelations highlight the vulnerability to online sabotage of automated and remotely controlled operational technology systems, and the growing resource gap faced by those charged with defending them. In the event of a war in the Pacific, if China seeks to undermine America’s will and ability to fight by crippling its civilian infrastructure, small town utilities might be on their own.
Two non-profit efforts launched last year to help fill the resource gap, but one has hit pause while it recalibrates and the other says lacks the resources to work in more than just a handful of states.
The usual presidential transition friction – the Cybersecurity and Infrastructure Security Agency still doesn’t have a Senate-confirmed leader – combined with layoffs and firings have hamstrung federal government efforts to support the cybersecurity of small town utilities, said Josh Corman, who’s worked for years on mobilizing cybersecurity volunteers for vital but under-resourced infrastructure.
Critical infrastructure hacking by global adversaries is especially alarming given that the targets of pre-positioning include communities with no connection to the U.S. military. “These are military hackers, prepositioning on civilian, non-combatant infrastructure so that they can target it as a precursor to armed conflict. It’s outrageous,” Corman told Information Security Media Group. “It’s a bad place to be in.”
Corman founded UnDisruptable27, a nonprofit that aims to prepare the nation’s life-critical services for a possible nation-state cyberattack by 2027. The date is a reference to U.S. intelligence reports that Chinese President Xi Jinping ordered his armed forces to be ready to retake Taiwan – and implicitly confront U.S. forces – that year.
Small and medium sized infrastructure providers like water utilities, power companies and hospitals are especially exposed to nation-state hacking because of their minor, mostly unseen role in heartland communities.
Utilities servicing small communities are target rich but cyber poor, as the formulation first voiced by Cisco’s Wendy Nather has it. “They don’t have cybersecurity staff. They don’t have a cybersecurity budget. They don’t even have IT staff in many cases, let alone people to protect OT or industrial control systems,” Corman said.
The cybersecurity of electricity generators and distributors is highly regulated. In contrast, “water is unguarded” despite how the cascading consequences of a successful cyberattack on a water utility are no less terrifying.
“No water means no hospitals,” said Corman. Most hospitals would close after just a few hours. “HVAC needs water, sanitation needs water. Fire suppression needs water, sterilization surgery scrubbing… If you lose water pressure to a hospital, you have to evacuate within two to four hours, especially if it’s in the heat in somewhere like Arizona, and 117 degrees when the air conditioning stops working.”
UnDisruptable27 started with a theory of the case that there was an “information gap” that they could fill by mobilizing cybersecurity volunteers to educate utility owners and operators about how to secure their systems.
Corman soon realized the problem was much larger and more complicated than that. Owners and operators were only one set of stakeholders, alongside local political leaders, citizens and cybersecurity experts. And the resource gap was bigger than he imagined.
There are roughly 150,000 water facilities in the United States. “There’s no way we’re going to successfully shield up and cyber up with no talent, no time and no money,” Corman said. “We thought we had an information gap, but we actually have a motivation and enablement, empowerment gap.”
Given the depth of the problem, UnDisruptable27 has paused volunteer recruitment while it develops a series of 12 case studies which would serve as playbooks for all the stakeholders involved.
Borrowing pages from the well-thumbed playbook of disaster management, UnDisruptable27 will use a local-first, bottom up approach, and will start with the proposition that “the punch will be thrown and will connect,” Corman said, “How can we best mitigate the impact? How can we be sure we can take the punch and roll with it and get back up as quickly as possible?”
In most cases, he added, that won’t mean trying to harden IT systems against intrusion, but engineering OT systems so as to minimize damage from an inevitable intrusion, an approach known as cyber-informed engineering.
“It’s not cyber up, its connections down,” said Corman.
Cyber-informed engineering offers low cost solutions to practical problems. Corman gave as an example of the trend for new systems that lack manual overrides. In some new installations, a wheel that sits atop the remote controlled valve that allows a manual override is no longer built. “Making sure there’s a wheel” is a low cost measure that would help ensure the provider is resilient.
DEFCON Franklin, an initiative based at the University of Chicago’s Harris School of Public Policy and run by former Biden White House cybersecurity official Jake Braun, also launched last year.
Braun said DEFCON Franklin had engaged “dozens of volunteers on a host of activities,” working with utilities across four states: Indiana, Oregon, Utah and Vermont.
But he acknowledged that “It will be extremely difficult to scale these efforts organically across 50,000-plus US water systems. In order to deliver services and hands-on support to water utilities at scale, federal and or state and local governments must step up with significant funding.”
Braun said that there were trust issues with the “tight-knit communities” of small water utility owners and operators, who tended to be “intrinsically averse to bringing in an ‘outsider’ to help, no matter their credentials.”
He added that DEFCON Franklin was working with the National Rural Water Association “to build up a level of trust across our participating water utilities” and scale their work further.