Tag Archives: critical infrastructure

Defending Against the Inevitable Hacks

The inevitable hacks are a way of life as cyberattacks rapidly proliferate. But you can limit the inevitable damage.

And when I say that cyberattacks rapidly proliferate, I do mean rapidly. Ask Route Fifty:

“The window between vulnerability discovery and exploitation has practically been reduced to zero.”

Which doesn’t help when you publicize an attack vector before the vendor plugs it. Marcus Hutchins recently vented:

“Just to be 100% clear, we came within a hair of having one of the worst mass-exploitation events in recent history, all because the Chainguard CEO unilaterally decided to break PHP’s embargo. Chainguard’s release resulted in someone being able to reproduce the exploit and release it publicly, 4 hours ahead of the patch being released.”

Combine all of it, and in the current environment assume that the hackers WILL get you. So what do you do?

That’s why Route Fifty talked about resilience:

“Since attackers move faster than agencies can remediate vulnerabilities, resilience must depend on what happens after an attacker gets in. The ability to contain an intrusion before it spreads to critical systems and disrupts public services is critical.”

Critical systems? I’ve talked about those: water, energy, transportation. If a hacker gets into these or other critical infrastructure systems, the hacker can massively disrupt operations…unless you insulate your system from disruption.

To protect our critical infrastructure from the inevitable hacks, these systems (and non-critical systems also) need to contain movement by the attackers, segment the subsystems, and support “the ability to isolate a compromised system while keeping unaffected systems running,”

Critical Infrastructure Cybersecurity Reporting…Maybe

As I’ve mentioned previously, there are 16 critical infrastructure sectors in the United States. If they’re breached, we’re in trouble. So the government has been working on regulations to govern critical infrastructure cybersecurity reporting by the 316,000 covered entities.

But it’s been a long haul.

Especially since the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was passed in 2022, and we haven’t seen any reporting per se yet.

As you probably know, passage of legislation doesn’t mean anything, because the federal executive department agencies need to translate the law into more specific regulations.

And that’s still a work in progress for CIRCIA. The first draft of the new rules was published in 2024, but hasn’t been finaliced. There was a target date of October 2025, but it wasn’t met. Then a target date of May 2026 wasn’t met. Now the target date is in September; we’ll see.

So what will the new regulations possibly entail? In addition to 72-hour incident and 24-hour ransom-payment reporting, look for these:

“Under the proposed rule, covered entities would be required to retain records and information related to reported incidents for two years, including technical evidence, logs, communications, and any other information associated with the incidents.

“While these changes introduced new requirements for covered entities, CIRCIA will also shield submitted reports from Freedom of Information Act (FOIA) disclosure and from being used as evidence in enforcement actions – unless they waive these privileges.”

The details of critical infrastructure cybersecurity reporting may be shielded from FOIA disclosure. Google Gemini.
The details of critical infrastructure cybersecurity reporting may be shielded from FOIA disclosure. Google Gemini.

Now there are pros and cons to this. Yes, prevention of FOIA disclosure will prevent concerned citizens from knowing about vulnerabilities…but it will also prevent the fraudsters from going straight to the government for handy cybercrime tips.

Now we’ll see when the regulations actually roll out.

Energy and International Critical Infrastructure

I have previously noted that water is part of the United States’ critical infrastructure, and has been designated as such by the U.S. government.

But there are fifteen other critical infrastructure segments, including energy:

“The energy infrastructure is divided into three interrelated segments: electricity, oil, and natural gas. The U.S. electricity segment contains more than 6,413 power plants (this includes 3,273 traditional electric utilities and 1,738 nonutility power producers) with approximately 1,075 gigawatts of installed generation. Approximately 48 percent of electricity is produced by combusting coal (primarily transported by rail), 20 percent in nuclear power plants, and 22 percent by combusting natural gas. The remaining generation is provided by hydroelectric plants (6 percent), oil (1 percent), and renewable sources (solar, wind, and geothermal) (3 percent). The heavy reliance on pipelines to distribute products across the nation highlights the interdependencies between the Energy and Transportation Systems Sector. 

“The reliance of virtually all industries on electric power and fuels means that all sectors have some dependence on the Energy Sector. The Energy Sector is well aware of its vulnerabilities and is leading a significant voluntary effort to increase its planning and preparedness. Cooperation through industry groups has resulted in substantial information sharing of best practices across the sector. Many sector owners and operators have extensive experience abroad with infrastructure protection and have more recently focused their attention on cybersecurity.”

And no, there’s not an omission. Nuclear is a separate sector.

And obviously the United States is not the only country dependent on energy, as residents of the United Kingdom found out.

“It seems that the Iranians were successful in taking a UK power plant for four days back in July….

“[H]ackers believed to be affiliated with the Iranians were behind the attack. British officials declined to identify the site for security reasons, and the government has described it only as a small-scale energy generator….

“the target was a small gas-fired ‘peaker’ plant. These facilities are designed to provide additional electricity when demand rises or when other sources are producing less power.”

Brian Harris speculates that programmable logic controllers (PLCs) were the target, as they were in the U.S. water cybersecurity attacks.

When critical infrastructure components are online, everything is a potential target.

Water, Programmable Logic Controllers, Iran, and Critical Infrastructure

Here in the southwestern United States, water or the lack thereof may be so contentious that we blithely say that we have to fight for it.

Meanwhile, things happen.

“Water and wastewater utilities in at least seven states have now reported cybersecurity incidents involving Internet-facing programmable logic controllers (PLCs), according to the FBI and the Environmental Protection Agency (EPA)….Specific states were not named.”

But at least four incidents HAVE been explicitly named.

“Meanwhile, Minnesota officials announced this week that at least 30 community water systems across the state were hit with malicious cyber activity, and an investigation is ongoing there….

“Four Minnesota city water organizations publicly announced cyber incidents, but others are unidentified. Braham’s water plant went temporarily offline; Plymouth announced impacts to automated controls and cellular-connected equipment at water towers and lift stations; South St. Paul announced a cybersecurity incident on automated controls; and Maple Plain declared a temporary emergency.”

Now perhaps this is just a bunch of instances of kids messing around.

Beavis and Butt-Head at Hoover Dam.

Or perhaps it’s something else.

“The authoring agencies urgently warn U.S. organizations of ongoing Iranian-affiliated cyber targeting of internet-connected operational technology (OT) devices, including programmable logic controllers (PLCs).”

Yes, Iran. You may recall that we are at war with them.

This brings these incidents into the realm of critical infrastructure. Among our 16 critical infrastructure sectors is the water and wastewater sector.

“In the United States, there are approximately 152,000 public drinking water systems, including 50,000 community water systems, and more than 16,000 wastewater treatment systems. Over 80 percent of the U.S. population receives their potable water from these drinking water systems, and about 75 percent have their sanitary sewerage treated by these wastewater systems. 

“The Water and Wastewater Systems Sector is vulnerable to various threats, including physical attacks, cyberattacks, and contamination with harmful agents. Such incidents could result in widespread illness, casualties, and service disruptions, significantly impacting public health and economic stability.”

Messing up someone’s computer is bad enough. But messing up their glass of drinking water is devastating. And whether the damage is done by a state-sponsored terrorist or by Beavis, you want to prevent it from happening.

Google Gemini.

The United States’ 16 Critical Infrastructure Sectors

I was working with these sectors back when I was at MorphoTrak.

“There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof. Presidential Policy Directive 21 (PPD-21): Critical Infrastructure Security and Resilience advances a national policy to strengthen and maintain secure, functioning, and resilient critical infrastructure. This directive supersedes Homeland Security Presidential Directive 7.”

The sectors are:

See:

https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors

https://www.cisa.gov/resources-tools/resources/presidential-policy-directive-ppd-21-critical-infrastructure-security-and

Water is (literally) critical and needs to smarten up

Water is (literally) critical and needs to smarten up

Presidential Policy Directive 21 (2013), the successor to Homeland Security Presidential Directive 7 (2003), defines 16 critical infrastructure sectors that need to be protected by the U.S. Department of Homeland Security and other entities.

There are 16 critical infrastructure sectors whose assets, systems, and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.

Some of the critical infrastructure sectors are obvious at first glance, including sectors such as transportation systems, nuclear reactors/materials/waste, and government facilities. But these aren’t the only ones. Take the Water and Wastewater Systems sector, overseen by the Environmental Protection Agency (EPA).

Safe drinking water is a prerequisite for protecting public health and all human activity. Properly treated wastewater is vital for preventing disease and protecting the environment. Thus, ensuring the supply of drinking water and wastewater treatment and service is essential to modern life and the Nation’s economy.

Look at the pain that we’ve suffered because of water issues in Flint, Michigan and other cities. Now imagine what would happen if the water in a larger region, such as the Colorado River valley, were to become undrinkable.

Oh yeah, climate change.

Data show extreme weather events are increasing. This is challenging utility providers who are managing critical infrastructure around the globe. The year 2020 was truly devastating for wildfires. From California to Australia, the world got a firsthand glimpse into how warmer, drier conditions are causing harsher droughts — resulting in longer fire seasons and greater water scarcity.

Most of us don’t make a habit of reading Water Online, but this site published a recent article on the part that technology plays in preserving the water/wastewater critical infrastructure system. These technologies are converting our water infrastructure into “smart” infrastructure, a key part of any smart city.

One of the technologies that is making our water infrastructure “smart” is referred to as “digital twins.”

No, not “Twins is the New Trend” twins.

Here’s what “digital twins” means from the critical infrastructure perspective.

Digital twin technology is providing promise in this regard. Digital twins are software representations of assets and processes that help understand, predict, and optimize performance to achieve improved business outcomes. Digital twins consist of three components — a data model, a set of analytics or algorithms, and knowledge — and are extremely valuable when it comes to predicting the impact of a storm for sewage and stormwater management.

Digital twins, like weather, are revised as more data is gathered and more information becomes available. Like any science, we don’t know everything on day 1, but if we continue to gather information and test hypotheses we will know more on day 2, and then even more on day 145.

The benefit of digital twins? Lower repair costs by better targeting of responses.

For more about smart water, see this article in Water World.