Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

09:50 PM
Connect Directly

Should Trump Tackle Air-Gapped Critical Infrastructure?

MIT experts issue recommendations to the president, urging him to take elements of the electric grid and gas pipeline offline - but other security experts say that ship has sailed.

Experts from the Massachusetts Institute of Technology and stakeholders from US critical infrastructure companies weighed in today with a host of recommendations for the Trump administration on how to take meaningful action to protect the nation's vital systems. In addition to the usual advice to quit delaying a decision, the experts' report took a stand by suggesting that critical components of the electrical grid and gas pipeline need to be taken offline.

The advice comes by way of a major report out from MIT's Internet Policy Research Initiative at the Computer Science Artificial Intelligence Laboratory. The report is the culmination of a year's worth of work reaching out to stakeholders across four major economic sectors: electricity, finance, communications, and oil and natural gas. Written by a group of luminaries headed by principal author Joel Brenner, a former inspector general for the National Security Agency, the report offers a handful of pointed recommendations to the president about how critical infrastructure security coordination needs to be expeditiously advanced.

As the Trump administration starts to float proposed executive actions in regard to improving federal cybersecurity, there's been very little said about bolstering the protection of privately owned critical infrastructure. The authors of the report warn that this could be to the country's great detriment. They say that coordinated improvement of national cybersecurity interests must include privately owned critical infrastructure if the US is going to make meaningful headway in improving the national risk posture.

"The nation can no longer afford a pattern of uncoordinated executive action and scattershot research," the authors say. "Total security is not achievable. But a materially improved security environment for the infrastructure on which virtually all economic and social activity depends can be created with sufficient resources and political will."

One of the biggest technical bones of contention the authors have regards the widespread access by critical control components of the US electrical grid and gas pipelines to the public Internet. The report states that security pros overwhelmingly believe at least certain aspects of their systems need to be air-gapped from public networks. The problem is deciding which aspects.

"There are significant differences of opinion about appropriate degrees of isolation," the authors admit. They recommend to the president that his administration expedite in coordination with the Federal Energy Regulatory Commission and the North American Electric Reliability Corporation, a conference of state electricity regulators, to "explore the feasibility and expense of isolating key elements of electricity generation and delivery from public networks."

It's an interesting debate because, in many instances, the industrial control system (ICS) environment is growing more connected to public networks than ever.

"It seems counterintuitive, this recommendation, because the myth of the air gap disappeared years ago," says Phil Neray, vice president of industrial cybersecurity for CyberX. "And it's getting even more unfeasible to do an air gap now when we're moving towards smart grids and smart manufacturing, when there's an even bigger need to connect the [operation technology] to the IT network in order to do analytics and real-time intelligence."

According to Lane Thames, software development engineer and security researcher with Tripwire's vulnerability and exposure research team, the security community must face these facts with planning that takes into account the convergence of the cloud, the industrial Internet, and the Internet of Things, which is already happening now. Companies are moving forward with it to not only improve the efficiency of the essential infrastructure but also to improve reliability.

"Newer industrial control systems will, indeed, have connections to the cloud for applications such as big data analytics and such. For example, predictive maintenance, which is key for advanced smart manufacturing, requires such technology," he explains. "These cloud-based applications will also come with communication paradigms that essentially break, as a minimum, our current standard views and best practices of security in terms of perimeters and segmentation."

These aren't trends that can easily be stemmed, and air-gapping systems with increasingly complex interconnections will not only be unrealistic from a business sense but also technically difficult to do. Neray says that there are better way of mitigating the risks, namely through continuous monitoring for anomalies and continuous assessment for vulnerabilities in critical systems, as well as improving information sharing between public and private sector stakeholders.

More Than Technology
Whatever the technical solutions look like, experts seem to agree that it will take more than just technological advancement to move forward on critical infrastructure security.

"The challenges we face are not merely technical. They are also economic, managerial, behavioral, political, and legal. Indeed, the technical challenges may be the easiest to address. For example, aligning economic, tax, and liability incentives with the goal of higher security is not a technical challenge," the report said. "Realigning incentives would be a daunting task, but our critical infrastructure cannot be made reasonably secure unless we do."

Richard Clarke, for one, believes that it's going to regulation — a dirty word in Washington — to really make a dent in thing. At the S4 conference earlier this year, he suggested that the country needs to set regulatory deadlines industry by industry for rolling out security enhancements to new and legacy systems that affect critical infrastructure. He believes that the research for the right technical solutions will only follow this kind of hard-and-fast regulation, because significant investments need to be made.

"In the absence of regulation, none of this is going to happen," he said. "In the absence of regulation, no one company is going to say, 'I'm going to do this.' In the absence of regulation, no one sector is going to say, 'We are going to do this.'"

For his part, Neray agrees with the MIT report that tax incentives could also help do the trick.

"Tax incentives would be a great way to do it," he says. "Tax incentives are just generally more popular than more regulation. And incentives to spend more on continuous monitoring to protect our infrastructure — that sounds like a no-brainer to me."

Related Content:

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Joe Stanganelli
Joe Stanganelli,
User Rank: Ninja
3/30/2017 | 11:39:01 AM
Security ain't "Smart"
The real issue here is the perennial conflict between security and accessibility -- which are exact opposites of each other.  You can't have accessibility with 100% security, and you can't have security with 100% accessibility.

Similarly, you can't have a secure infrastructure AND IoT.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-24
vm/opcodes.c in JerryScript 2.2.0 allows attackers to hijack the flow of control by controlling a register.
PUBLISHED: 2020-09-24
PrestaShop from version and before version is vulnerable to a blind SQL Injection attack in the Catalog Product edition page with location parameter. The problem is fixed in
PUBLISHED: 2020-09-24
In PrestaShop from version and before version, users are allowed to send compromised files. These attachments allowed people to input malicious JavaScript which triggered an XSS payload. The problem is fixed in version
PUBLISHED: 2020-09-24
ActFax Version 7.10 Build 0335 (2020-05-25) is susceptible to a privilege escalation vulnerability due to insecure folder permissions on %PROGRAMFILES%\ActiveFax\Client\, %PROGRAMFILES%\ActiveFax\Install\ and %PROGRAMFILES%\ActiveFax\Terminal\. The folder permissions allow "Full Control" t...
PUBLISHED: 2020-09-24
Improper directory permissions in the Hotspot Shield VPN client software for Windows 10.3.0 and earlier may allow an authorized user to potentially enable escalation of privilege via local access. The vulnerability allows a local user to corrupt system files: a local user can create a specially craf...