Critical infrastructure like power generation and distribution, government institutions, airports, and hospitals, are becoming more reliant on the network of connected devices. Years ago, power plants and other critical infrastructures were operated in isolation. But now, they are more interconnected. Therefore, the vulnerability of critical infrastructure leading to technical failures and cyber-attacks has become a major concern.
The complexities of critical infrastructure may lead to unplanned or unexpected interactions among system components. The exploitation of these implicit interactions has a potential impact on the security, reliability, and safety of a critical system and its operation. This unpredictable system behavior can allow hackers to disrupt system operations.
In this article, we will discuss the threat of cybercriminals to critical infrastructures, such as Intelligent Transportation Systems, power plants, government institutions, airports, and similar.
What is Critical Infrastructure?
Critical infrastructure (CI) is an architecture of networks, systems, and assets that are essential, and their continued operation is required for ensuring the security of a nation, its economy, and public health or safety. It includes a vast network of highways, railways, connected bridges and tunnels, and buildings required to maintain routine life. Clean water, transportation, and electricity all rely on these critical systems.
In simple words, critical infrastructure refers to that essential information and physical technology facilities, services, assets, and networks, which if disrupted would have a potential impact on the safety, security, health, economic, or social well-being of the public and government. It’s the backbone of everyday life in this digital era.
Critical Infrastructure Security
Critical infrastructure security is an area of concern surrounding the protection of networks, systems, and assets whose continuous operation is necessary to ensure security. It’s a need to protect a region’s critical infrastructure, such as agriculture, food, or transportation. Every government has a responsibility to protect these critical infrastructures against terrorist attacks, disasters, and now cyber threats.
From transportation companies to energy organizations, it is essential that security in all vital infrastructure sectors is of the highest standard and that disaster recovery and response are top priorities. Common elements of critical infrastructure requiring security considerations include SCADA systems, Industrial Control Systems (ICA), and Operation Technology (OT).
The world is rapidly evolving, and physical and digital systems are converging. Systems that were working in isolation managing critical infrastructure operations are now connecting to the Internet and sharing sensitive data. This advancement towards digital technologies brings with it new security issues.
Critical infrastructure organizations should leverage a robust security framework that can mitigate the risk of cyber-attacks and disasters across their entire CI environment. Critical infrastructure security helps businesses prepare for and respond to security incidents and protect against the ever-evolving threat landscape.
Top 7 cyber threats on critical infrastructure
Here are the top five cyber risks and threats to critical infrastructure security every organization needs to be prepared for defense against them in this digital era.
1. Network Segmentation
It is an architectural approach dividing a network into various segments that allow network administrators to control the traffic flow based on the defined administration policies. Malicious actors can run malware inside an organization’s network infrastructure when there is a lack of network segmentation and access the valuable assets, such as personnel data and highly confidential intellectual property.
2. Phishing
It’s a well-known cyber threat that can be defined as a social engineering technique aiming to take over sensitive information replacing the identity of a person or a company of trust for the individual to attack. The interest it follows can be very diverse, from gathering information on a prototype of the project to credentials of process engineers or system administrators, including OT equipment details. Phishing is an entrance door to malware.
3. Malware attacks
These attacks can have a devastating impact on critical infrastructure. The malware in any of its forms, like Trojans, rootkits, worms, etc, can have various purposes. These can include denial of service, escalation of privileges, pivoting, and subrogating. And the results can be diverse, for instance, the network flooding with broadcast traffic, the capture of equipment activity, change of parameters and configurations, and the scan of host and services. This information can be sent to command and control for its exploitation and to carry our various options.
4. Distributed Denial of Service (DDoS) attacks
DDoS attacks have the potential to disrupt an organization’s public cloud infrastructure and impact the availability of organizations running critical infrastructure in the cloud. This type of malicious attack can be crippling for any organization, timing out requests or slowing systems down while consuming a large amount of processing power.
Today’s hackers have contrived increasingly sophisticated methods of carrying out an assault before thousands of automated requests for service can be identified and screened. This scenario makes it difficult for security experts to detect which component of incoming traffic is from a malicious actor and which are from authorized users.
5. Web application attacks
Traditional Operation technology (OT) systems, such as Programmable Logic Computers (PLC) and Human Management Interfaces (HMI), are increasingly connected to the network. They are also accessible using remote access that makes them particularly vulnerable. Exposed and unprotected systems are vulnerable to SQL injection and cross-site scripting attacks.
Organizations are recommended to use Web Application Firewalls (WAF) and Content Delivery Networks (CDN) and share critical resources with admins while conducting regular security audits to detect vulnerabilities.
6. Command injection and parameter manipulation
Command injection is one of the most devastating groups of existing vulnerabilities. It can occur when an unverified, user-controlled input is given as validated input for execution calls. The threats occur when dynamically built commands are used by a criminal to perform arbitrary code execution on underlying operating systems.
Contaminated data that is not verified as legitimate system traffic provides hackers the power of executing arbitrary system commands on the OT system by appending additional commands to the predetermined command string. Similar to SQL injection attacks, the initial point of this threat starts when the system is unable to validate user input properly.
7. Weak or stolen credentials
Weak and repeated passwords make credential exposure a gateway for initial criminal access and propagation. Malware attacks, such as Mirai highlight this attack vector not only for managed devices but also for IoT-connected devices. Applications and protocols that send login credentials over the network pose a significant cyber threat.
An attacker connected to the company’s network can easily locate and use these credentials for lateral movement. For instance, in the criminal attack, adversaries were able to steal the Active Directory credentials and spread their attack into the enterprise payment network.
Best Practices to Ensure Critical Infrastructure Security
Here are a set of best practices for security experts tasked with protecting OT assets and critical infrastructure. Most of this advice is familiar to those running on-site security operations centers for industrial control systems.
- Foster a cybersecurity culture_ Human error is a major cause of cyberattacks. With zero-day and phishing attacks, the system gets compromised when an employee downloads a malicious file, providing their credentials to criminals. Organizations should develop efficient incident response plans to encourage transparency by reporting attacks to the government and sharing best practices throughout the network.
- Implement best practices_ There is a need to adopt best practices for implementing a cybersecurity culture. These include installing anti-malware software, firewalls, security information and event management (SIEM), data encryption, multi-factor authentication, and trust zones.
- Invest in both physical and digital security_ Fostering a cybersecurity culture and implementing best practices has a price tag, but hackers always try to find IT/OT network vulnerabilities. Therefore, there is a need to expand cybersecurity teams in organizations and invest in physical security.
- Clarify leadership and promote clear communication_ Security vulnerabilities stem from a lack of leadership and communication within an organization. With so many websites, assets, networks, and teams, it can be true for critical infrastructure providers.
- Audit assets, devices, and other network components_ You can not protect what you do not understand. Therefore, it is essential to audit assets, devices, and systems within your network.
- Apply zero trust model_ Consider implementing the zero trust model to every operator controller input. It’s a model in which all operator controller input is treated as a potentially malicious component until proven safe.
- Segment IT/OT network_ and use hardening techniques for protecting devices that can be accessed remotely by employees. These include changing default credentials, disabling unused services, creating whitelisting policies, and reviewing asset configurations.
Conclusion
Cyberattacks on critical infrastructure are a real threat, and governments across the globe are already taking notice. As with all cybercrimes, it’s a battle for cybersecurity experts and governments to keep pace with the tactics and sophisticated technologies being deployed by hackers. The risks posed by the cyber-criminal and critical infrastructure attacks now extend to impact human safety and health.
These attacks have never been more pressing than they are now, and it’s essential for national security and enterprise risk management that security leaders must enforce consistent adherence to best practices. Having a Critical Infrastructure Protection (CIP) plan can help governments and organizations prepare for and prevent potential incidents involving CI environments.