Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

09:50 PM
Connect Directly

Should Trump Tackle Air-Gapped Critical Infrastructure?

MIT experts issue recommendations to the president, urging him to take elements of the electric grid and gas pipeline offline - but other security experts say that ship has sailed.

Experts from the Massachusetts Institute of Technology and stakeholders from US critical infrastructure companies weighed in today with a host of recommendations for the Trump administration on how to take meaningful action to protect the nation's vital systems. In addition to the usual advice to quit delaying a decision, the experts' report took a stand by suggesting that critical components of the electrical grid and gas pipeline need to be taken offline.

The advice comes by way of a major report out from MIT's Internet Policy Research Initiative at the Computer Science Artificial Intelligence Laboratory. The report is the culmination of a year's worth of work reaching out to stakeholders across four major economic sectors: electricity, finance, communications, and oil and natural gas. Written by a group of luminaries headed by principal author Joel Brenner, a former inspector general for the National Security Agency, the report offers a handful of pointed recommendations to the president about how critical infrastructure security coordination needs to be expeditiously advanced.

As the Trump administration starts to float proposed executive actions in regard to improving federal cybersecurity, there's been very little said about bolstering the protection of privately owned critical infrastructure. The authors of the report warn that this could be to the country's great detriment. They say that coordinated improvement of national cybersecurity interests must include privately owned critical infrastructure if the US is going to make meaningful headway in improving the national risk posture.

"The nation can no longer afford a pattern of uncoordinated executive action and scattershot research," the authors say. "Total security is not achievable. But a materially improved security environment for the infrastructure on which virtually all economic and social activity depends can be created with sufficient resources and political will."

One of the biggest technical bones of contention the authors have regards the widespread access by critical control components of the US electrical grid and gas pipelines to the public Internet. The report states that security pros overwhelmingly believe at least certain aspects of their systems need to be air-gapped from public networks. The problem is deciding which aspects.

"There are significant differences of opinion about appropriate degrees of isolation," the authors admit. They recommend to the president that his administration expedite in coordination with the Federal Energy Regulatory Commission and the North American Electric Reliability Corporation, a conference of state electricity regulators, to "explore the feasibility and expense of isolating key elements of electricity generation and delivery from public networks."

It's an interesting debate because, in many instances, the industrial control system (ICS) environment is growing more connected to public networks than ever.

"It seems counterintuitive, this recommendation, because the myth of the air gap disappeared years ago," says Phil Neray, vice president of industrial cybersecurity for CyberX. "And it's getting even more unfeasible to do an air gap now when we're moving towards smart grids and smart manufacturing, when there's an even bigger need to connect the [operation technology] to the IT network in order to do analytics and real-time intelligence."

According to Lane Thames, software development engineer and security researcher with Tripwire's vulnerability and exposure research team, the security community must face these facts with planning that takes into account the convergence of the cloud, the industrial Internet, and the Internet of Things, which is already happening now. Companies are moving forward with it to not only improve the efficiency of the essential infrastructure but also to improve reliability.

"Newer industrial control systems will, indeed, have connections to the cloud for applications such as big data analytics and such. For example, predictive maintenance, which is key for advanced smart manufacturing, requires such technology," he explains. "These cloud-based applications will also come with communication paradigms that essentially break, as a minimum, our current standard views and best practices of security in terms of perimeters and segmentation."

These aren't trends that can easily be stemmed, and air-gapping systems with increasingly complex interconnections will not only be unrealistic from a business sense but also technically difficult to do. Neray says that there are better way of mitigating the risks, namely through continuous monitoring for anomalies and continuous assessment for vulnerabilities in critical systems, as well as improving information sharing between public and private sector stakeholders.

More Than Technology
Whatever the technical solutions look like, experts seem to agree that it will take more than just technological advancement to move forward on critical infrastructure security.

"The challenges we face are not merely technical. They are also economic, managerial, behavioral, political, and legal. Indeed, the technical challenges may be the easiest to address. For example, aligning economic, tax, and liability incentives with the goal of higher security is not a technical challenge," the report said. "Realigning incentives would be a daunting task, but our critical infrastructure cannot be made reasonably secure unless we do."

Richard Clarke, for one, believes that it's going to regulation — a dirty word in Washington — to really make a dent in thing. At the S4 conference earlier this year, he suggested that the country needs to set regulatory deadlines industry by industry for rolling out security enhancements to new and legacy systems that affect critical infrastructure. He believes that the research for the right technical solutions will only follow this kind of hard-and-fast regulation, because significant investments need to be made.

"In the absence of regulation, none of this is going to happen," he said. "In the absence of regulation, no one company is going to say, 'I'm going to do this.' In the absence of regulation, no one sector is going to say, 'We are going to do this.'"

For his part, Neray agrees with the MIT report that tax incentives could also help do the trick.

"Tax incentives would be a great way to do it," he says. "Tax incentives are just generally more popular than more regulation. And incentives to spend more on continuous monitoring to protect our infrastructure — that sounds like a no-brainer to me."

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
3/30/2017 | 11:39:01 AM
Security ain't "Smart"
The real issue here is the perennial conflict between security and accessibility -- which are exact opposites of each other.  You can't have accessibility with 100% security, and you can't have security with 100% accessibility.

Similarly, you can't have a secure infrastructure AND IoT.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/14/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-07-15
The IRC5 family with UAS service enabled comes by default with credentials that can be found on publicly available manuals. ABB considers this a well documented functionality that helps customer set up however, out of our research, we found multiple production systems running these exact default cre...
PUBLISHED: 2020-07-15
IRC5 exposes an ftp server (port 21). Upon attempting to gain access you are challenged with a request of username and password, however you can input whatever you like. As long as the field isn't empty it will be accepted.
PUBLISHED: 2020-07-15
An issue was discovered in drivers/acpi/acpi_configfs.c in the Linux kernel before 5.7.7. Injection of malicious ACPI tables via configfs could be used by attackers to bypass lockdown and secure boot restrictions, aka CID-75b0cea7bf30.
PUBLISHED: 2020-07-15
In Eclipse OpenJ9 prior to version 0.21 on Power platforms, calling the System.arraycopy method with a length longer than the length of the source or destination array can, in certain specially crafted code patterns, cause the current method to return prematurely with an undefined return value. This...
PUBLISHED: 2020-07-15
An issue was discovered in drivers/firmware/efi/efi.c in the Linux kernel before 5.4. Incorrect access permissions for the efivar_ssdt ACPI variable could be used by attackers to bypass lockdown or secure boot restrictions, aka CID-1957a85b0032.