Critical infrastructure warrants mandatory safeguards and sufficient funding

Numerous high-profile cybersecurity breaches over the past year have changed the way we think about infrastructure, prompting a reevaluation of what must be done to protect the assets that ensure national security and the resources that safeguard our competitiveness as a nation. 

It’s important to note that the definition of critical infrastructure has been expanded to include cyber and information assets as well as the physical plants. According to the Department of Homeland Security’s Critical Infrastructure Security Agency (CISA), the physical and virtual assets, systems and networks of the 16 critical infrastructure sectors “are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety, or any combination thereof.”

To prevent cyberattacks and the resulting damage, the Biden administration has moved cybersecurity higher on its list of priorities and taken a number of actions, including issuing a cybersecurity executive order, imposing mandatory standards rather than advisory guidance for pipelines, requesting additional funding for IT modernization and improved federal agency cybersecurity and, most recently, directing the National Institute of Standards and Technology (NIST) to develop a new framework to improve supply chain security. Moreover, Congress’ historic infrastructure bill has significant cybersecurity implications. 

These steps are long overdue, but are they enough? Here are some concerns I still have:

Much guidance is still voluntary. In 2014 NIST published the Cybersecurity Framework to help critical infrastructure organizations (many of which are privately owned or managed and mostly regulated at the state and local levels) better manage cyber risk. But the NIST CSF guidance, issued pursuant to the direction of Congress, is not mandatory, and the “voluntary nature of the framework” was frequently cited in a 2020 Government Accountability Office report as an impediment to improving critical infrastructure cybersecurity. The only significant exceptions to this voluntary approach to cybersecurity guidance for the private sector are recent steps by the Transportation Security Administration to mandate certain steps to secure pipelines.

The growing incidence of cyberattacks against critical infrastructure, including hospitals, water treatment facilities, pipelines, etc., have pushed us to the tipping point: it is time to put more teeth behind efforts to protect the cyber operations related to infrastructure.

Inadequate funding. A problem many private- and public-sector organizations face is the lack of financial resources to address vulnerabilities. Because of budgetary constraints, too often security is an unfunded objective. That’s why the infrastructure bill winding its way through Congress is so important. It would help address some cybersecurity funding issues for critical infrastructure, with a specific emphasis on funding and technical assistance for the energy sector and water treatment systems, as well as for state and local governments and educational systems.

However, the $1.9 billion provided in the bill for cybersecurity, of which $1 billion would be directed to state and local governments, only represents less than .2 of 1% of the $1.1 trillion total funding in the bill. Which begs the question, why invest so much in long-term infrastructure if the systems that run it are left unprotected? Cybersecurity must be thoroughly baked into infrastructure projects funded by this legislation.

The cybersecurity funding in the bill is also far less than what is needed. Do the math. Spread $1 billion over four years, and then divide that by 50 states, the various territories, commonwealths and tribal governments as well as thousands of local jurisdictions. Each will receive only a small fraction of what is necessary to address the constantly evolving threat. A one-time infusion of money won’t adequately protect enterprises over time.

Don’t misunderstand my point. It’s great that the legislation recognizes that cybersecurity is an important element of infrastructure. But the amount provided is not commensurate with the need. This is a good start, but it will require future dedicated federal appropriations, as well as other funding streams at the state and local levels, to maintain any progress resulting from the infrastructure bill.

Such investments in cybersecurity for critical infrastructure reflect CISA’s assertion that these sectors are so vital that damage to them would “have a debilitating effect on security, national economic security (and/or) national public health or safety.” That’s why we must build on Congress’ infrastructure legislation with future funding paths and make sure our critical infrastructure owners and operators better protect themselves by setting reasonable cybersecurity requirements for them. They are, in fact, too vital to our nation, to leave things to chance.