{"id":84166,"date":"2023-07-13T08:17:05","date_gmt":"2023-07-13T08:17:05","guid":{"rendered":"https:\/\/www.techopedia.com"},"modified":"2023-07-13T08:17:05","modified_gmt":"2023-07-13T08:17:05","slug":"securing-the-backbone-safeguarding-critical-national-infrastructure-for-a-resilient-future","status":"publish","type":"post","link":"https:\/\/www.techopedia.com\/securing-the-backbone-safeguarding-critical-national-infrastructure-for-a-resilient-future","title":{"rendered":"Securing the Backbone: Safeguarding Critical National Infrastructure for a Resilient Future"},"content":{"rendered":"
Security is an important subject that affects everyone. It\u2019s not just about protecting yourself from hackers<\/a> attempting to attack your computer or smart device or tricking you into taking the bait from a phishing<\/a> email. It\u2019s so much more than that.<\/p>\n It\u2019s about protecting our Critical National Infrastructures<\/a> (CNI), like water treatment facilities, nuclear power stations, and dams. A country\u2019s CNI requires strategic planning to ensure a robust defense to protect against natural disasters such as floods, hurricanes, earthquakes, tsunamis, and thunderstorms \u2013 unnatural disasters like arson and cyber attacks<\/a> from a nation-state threat actor, hacktivist, or cybercriminal.<\/p>\n CNIs encompass the essential assets, systems, and networks crucial for the smooth functioning of society and the economy. These elements are of utmost importance and warrant special protection; incapacity or destruction would have severe repercussions on security, national economic stability, and public health & safety.<\/p>\n The nature of CNI means that any threat to these sectors can have a knock-on effect with wide-reaching consequences. Protecting critical infrastructure necessitates the establishment of a national capability to identify and monitor critical elements. This capability lets us determine if the elements are under attack or impacted by destructive natural occurrences.<\/p>\n A proactive approach is crucial when protecting the components that comprise our critical national infrastructures, as they are the very foundation of our society.<\/p>\n The Department of Homeland Security (DHS) in America has identified approximately sixteen sectors that it considers vital or critical infrastructures.<\/p>\n The sectors that fall under critical infrastructure include:<\/p>\n The importance of critical national infrastructures cannot be overstated. These are the sectors that house assets, systems, and networks that are crucial to a country’s functioning. Any disruption or damage to these sectors would result in catastrophic consequences.<\/p>\n To put CNI\u2019s into context, think about our everyday domestic routines, things like taking a shower, the car wash, boiling a kettle, and filling up at the gas station. We don’t automatically think about water treatment facilities when using clean running water. Or the supply chain that feeds the petrol or gas station.<\/p>\n As mentioned, the list of CNI sectors goes much deeper than this, but these examples will help show the importance of keeping our CNI safe from attacks.<\/p>\n To further strengthen the security and resilience of critical infrastructure, collaborative efforts are undertaken by the government, and industry partners, through cyber and physical security exercises. These exercises aim to enhance the preparedness and responsiveness of all involved parties.<\/p>\n In the U.K., the National Protective Security Authority (NPSA) provides information, personnel, and physical security advice to the businesses and organizations which make up the U.K.’s CNI, helping to reduce its vulnerability to terrorism and other threats. It can call on resources from other government departments and agencies as well. These include MI5, the Communications-Electronics Security Group (CESG), the National Cyber Security Center (NCSC), and other government departments responsible for national infrastructure sectors.<\/p>\n There is an annual disaster response exercise called SIMEX (short for Simulated Exercise), which is the largest of its kind in the country. This exercise involves a range of activities, including live events, simulations, and command and control exercises, all aimed at testing disaster response plans, policies, and procedures. One important aspect of this exercise is testing critical sectors, such as finance, to assess their ability to withstand disruption and maintain operational resilience.<\/p>\n The U.S. conducts numerous exercises across its vast geographical expanse, tailored to each state’s specific needs. But imagine a world where disaster strikes and we are left unprepared, scrambling to protect our communities and recover from the chaos; what then? Thankfully, these exercises bring together the best minds in federal, state, local, tribal, private sector, and international partners.<\/p>\n One such program is the FEMA National Exercise Program (NEP), which aims to establish a consistent framework for designing, developing, conducting, evaluating, and planning exercise improvements.<\/p>\n Another critical exercise series is the National Level Exercise (NLE), held every two years, testing areas ranging from prevention and protection to mitigation, response, and recovery.<\/p>\n The Urban Shield exercise in the vibrant San Francisco Bay Area puts emergency responders to the test, pushing their limits and assessing their readiness. Then there\u2019s the Vigilant Guard exercise series, which focuses on enhancing the coordination and response capabilities of National Guard units and their civilian partners.<\/p>\n These exercises are not just simulations; they are opportunities to evaluate and refine emergency response systems, fostering collaboration and preparedness among various stakeholders.\u00a0<\/strong><\/p>\n The private sector develops robust systems to effectively identify and prevent attempted cyber and physical attacks. Comprehensive tests are conducted to identify any potential weaknesses or vulnerabilities. These tests are carried out using a mixture of automated tools and skilled penetration testers who employ both technological and manual approaches. Like a determined attacker, penetration testers will often perform site visits to see how close they can get to a control system.<\/p>\n Industrial control systems (ICS) are crucial in controlling and managing industrial processes across manufacturing, transportation, energy, and water treatment. These systems require round-the-clock protection to ensure seamless operations and optimal performance. Supervisory control and data acquisition<\/a> (SCADA) is employed to manage ICS effectively.<\/p>\n The federal government mandates that private industries within each critical economic sector assess their potential risks to physical and virtual interruption and implement measures to eliminate vulnerabilities and prevent attacks. The federal government has played a pivotal role in facilitating the monitoring and preparation for disabling events by developing a standardized description of critical infrastructure. This standardized framework allows for a comprehensive understanding and effective management of critical infrastructure vulnerabilities.<\/p>\n Lastly, critical infrastructure protection necessitates the establishment of a national capability to identify and monitor the key elements of critical infrastructure. By doing so, potential threats can be promptly identified, and appropriate actions can be taken to safeguard these critical assets.<\/p>\n In February 2021, Oldsmar, Florida’s west coast, experienced a cyberattack on its water supply. A hacker maliciously took charge of the Industrial Control Systems (ICS) and boosted the sodium hydroxide (Lye) level to 100 times higher than usual. Lye poisoning can cause burns, vomiting, severe pain, and bleeding.<\/p>\n On May 7, 2021, cybercriminals seized control of the Colonial pipeline through a Ransomware attack, which temporarily halted fuel supplies, causing fuel shortages, panic buying, and lengthy queues. The Colonial Pipeline Company promptly paid the hacker group (DarkSide) a ransom of 75 bitcoin, amounting to $4.4 million, within a few hours.<\/p>\n As you can see, the disruption to supply chains is far from trivial. The swift ransom payment highlights the significant impact even a single disruption can have on supply chains and the broader economy.<\/p>\n Safeguarding any CNI involves having an Incident Response (IR) plan in place and an entity responsible for implementing it, that is, an organization that oversees the security of a CNI.<\/p>\nProtecting the Backbone of a Nation<\/span><\/h2>\n
What Is Defined as Critical Infrastructure?<\/h3>\n
\n
Why Are Critical National Infrastructures So Important?<\/h3>\n
Making Sure It All Works<\/span><\/h2>\n
The Private Sector<\/h3>\n
Government Mandate<\/h3>\n
Security of Key Suppliers to the CNI<\/h3>\n
National Infrastructure Protection Plan<\/span><\/h2>\n