The good, bad, and potentially worse of critical infrastructure protection.

Steve Grobman, Chief Technology Officer at Intel Security

July 23, 2015

3 Min Read

There has been a significant post-9/11 focus on securing critical infrastructure systems – many of which pre-date the Networked Age and were potentially more vulnerable to attack than newer networked systems. Cyber-attacks on critical infrastructure systems have not yet resulted in the loss of human lives. And yet a number of recent events suggest that a closer look at the state of critical Infrastructure cybersecurity is necessary to determine progress and unfulfilled needs.

The annual Aspen Security Forum takes place this week in Aspen, CO. This two-day line-up of national security panels and 1:1 discussions presents a great forum to gauge the state of critical infrastructure cybersecurity. In cooperation with the Aspen Institute, Intel Security surveyed security professionals in energy production, financial services, transportation, telecommunications, and many government functions to determine what progress has been made, and what areas require greater attention.

Our survey results revealed the good, the bad, and the potentially worse of critical infrastructure protection:

·       The good news: no catastrophic loss of life and an improved confidence in critical infrastructure cyber security postures

·       The bad news: cyber-attacks are real, increasing, and capable of real, substantive damage to our critical infrastructure

·       The potentially ugly: attacks are likely to become fatal and could escalate from the digital to physical realms.

First, consider the good news.

Respondents demonstrate a significant degree of confidence in the state of their cybersecurity posture – confidence registered by both satisfaction in their security defenses and a perceived decline in vulnerability to attacks in recent years. Half of respondents considered their organizations “very or extremely” vulnerable three years ago. By comparison, 27 percent believe that their organizations are currently “very or extremely” vulnerable today.

Eighty-four percent are “satisfied” or “extremely satisfied” with the performance of their own security tools such as endpoint protection, network firewalls, and secure web gateways. If anything, the greatest threat to critical infrastructure appears to be human rather than technical. As we’ve seen in other areas, the most common cause of successful attacks on critical infrastructure is human error – users falling victim to social engineering such as spear phishing.

This confidence does not mean that they are complacent.

More than 70 percent think the threat to their organizations is escalating. Almost 9 out of 10 experienced at least one attack in the last three years that caused some damage, disruption, or data loss, with a median of close to 20 attacks per year. Forty-eight percent believe it likely to extremely likely that a critical infrastructure cyber-attack will result in human fatalities in the next three years.

While they continue to look at further investment in various security areas, the vast majority think that greater cooperation and public-private partnerships with national and international agencies are important to keep pace with the escalating threat landscape.

What form would these joint activities take? Well, the top rated suggestions were joining a national or international defense council to share threat intelligence and defense strategies, taking coordinated direction on cyber defense, or even national legislation that requires cooperation with government agencies. The majority of respondents felt that their own government as well as international agencies could be valuable and respectful partners in cybersecurity, and many were open to sharing network visibility if it was deemed vital to national or global cyber defense.

However, one caution was that more than three-quarters of the security professionals supported the use of national defense forces to retaliate in response to a fatal critical infrastructure attack within the country. Given that only a third think that nation-state security services are behind the serious attacks on their organization, identifying a target for retaliation is problematic. Even if a nation-state is responsible, how do you conclusively determine the source of the attack, when it is using code borrowed or bought from organized crime in one country and servers spread across 5 other countries?

It is essential for the public and private owners and managers of critical infrastructure to act now. Nobody wins if a digital conflict escalates into conventional, kinetic conflicts between nations. Developing successful public-private cooperation today will help us avoid military escalation scenarios tomorrow.

About the Author(s)

Steve Grobman

Chief Technology Officer at Intel Security

Steve Grobman is the chief technology officer for Intel Security Group at Intel Corporation. In this role, Grobman sets the technical strategy and direction for the company's security business across hardware and software platforms, including McAfee and Intel's other security assets.

 

Grobman joined Intel in 1994 as an architect in IT and has served in a variety of senior technical leadership positions during his Intel career. Before assuming his current role in late 2014, he spent a year as chief technology officer for the Intel Security platform division. Prior to that role, he spent two years as chief technology officer at Intel's subsidiary McAfee to integrate security technology from the two companies.

 

In prior roles, Grobman served as chief security technologist for the Intel Atom processor system-on-chip design group and spent seven years as chief architect for Intel vPro technology platforms. In the latter position, he led work on the solutions architecture that resulted in a business platform with unique hardware-based management and security capabilities.

 

Before joining Intel, Grobman spent four years at IBM as a solutions programmer and developer. Grobman has published a number of technical papers and books, and holds 20 U.S. and international patents in the fields of security, software, and computer architecture, with about another 20 patents pending. He is also the recipient of two Intel Achievement Awards, the first earned in 2005 for the invention, initial architecture, and strategy of the first PC embedded appliance; and the second in 2007 for the success of the Intel vPro technology platform.

 

Grobman earned his bachelor's degree in computer science from North Carolina State University

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights