Where do you draw the line on securing critical infrastructure?
Connecting state and local government leaders
Recent multistage attacks against high-value targets confirm what we should already know: It is difficult if not impossible to set limits on what kind of infrastructure is critical enough to receive cybersecurity attention.
The National Institute of Standards and Technology released its Cybersecurity Framework for critical infrastructure this week, a set of voluntary standards and best practices that the administration would like to see widely adopted by operators of systems critical to the nation’s economy and security.
The framework is a good and necessary step toward improving the nation’s cybersecurity, but it would be a mistake to think that it can achieve real security by itself. Multistage attacks against high-value targets are exploiting upstream vulnerabilities to provide easy access to critical resources in government as well as in sensitive private-sector systems.
Enforceable baseline standards for a much wider range of systems are necessary to prevent these attacks.
This vulnerability was brought home with the breach of RSA in 2011 that exposed critical data about the company’s SecurID authentication token. That began with a spear phishing attack against RSA’s parent company EMC, deploying a zero-day exploit to give attackers a foothold inside the company. This exposed RSA, and data stolen from the security company later was used in an attack against defense contractor Lockheed Martin.
A more recent example is the theft of information about tens of millions of credit cards. The attackers apparently used a network link with a heating, ventilation and air conditioning contractor to penetrate card payment systems at Target stores and possibly other retailers. The attack did not use HVAC control systems; the initial compromise could have been in almost any type of connected system.
The interconnections among information systems today make it difficult, if not impossible, to set limits on what infrastructure should be designated critical for government and the private sector. Multistage attacks can be simple or sophisticated, but they all exploit weak links that might in themselves be of little value. These attacks can then escalate access to critical resources without having to penetrate a hardened perimeter. They can avoid setting off intrusion alarms and can make the breaches more difficult to detect.
This does not mean that critical systems should not get close attention when it comes to cybersecurity. Effective security needs to be risk-based, which means that those systems presenting the greatest risk get the most attention. But it does illustrate the risk of sharply defining the perimeters of critical, high-value systems without considering what those systems are connected to, what those secondary systems are connected to and what those systems are connected to.
Cybersecurity is a big job, and when approaching a big job it makes sense to prioritize. But don’t be lulled into thinking the job is done when the top priority is completed. Priorities are like an old fashioned rail fence: If you take off the top rail, you’ll find another top rail beneath it. Even if our critical infrastructure is protected, we cannot assume that we are secure until the infrastructure that connects to it is secure, down to the HVAC contractors if necessary.
NEXT STORY: Got your security monitoring game in gear?