There has been plenty of talk about the threat of cyber-attacks on critical national infrastructure (CNI). So what’s the risk? What’s involved in protecting CNI? And why, to date, do attacks seem to have been limited?
CNI is the utility infrastructure that we all rely on day to day: national networks such as electricity grids, water supply systems and rail tracks. Others have an international aspect, too. For example, gas pipelines are often fed by cross-border suppliers. In the past such infrastructure has been often been owned by governments, but much has now been privatized.
Some CNI has never been in government hands. Mobile phone and broadband networks have largely emerged after the telco monopolies were scrapped in the 1980s. The supply chains of major supermarkets have always been a private matter, but they are very reliant on road networks, an area of CNI still largely in government hands.
The working fabric of CNI is always a network of some sort: pipes, copper wires, supply chains, rails, roads. Keeping it all running requires network communications. Before the widespread use of the internet this was achieved through propriety, dedicated and largely isolated networks. Many of these are still in place. However, the problem is that they have increasingly become linked to and/or enriched by internet communications. This makes CNI part of the nebulous thing we call cyber-space, which is predicted to grow further and faster with the rise of the internet of things (IoT).
Who would want to attack CNI? Perhaps terrorists – however, some point out that it is not really their modus operandi, regional power cuts being less of a horrifying spectacle than flying planes into buildings. CNIs could become a target in nation-state conflicts, perhaps taking the form of a surreptitious attack where there is no kinetic engagement (a euphemism for direct military conflict). Some say this is already happening; for example, the Stuxnet malware that targeted Iranian nuclear facilities.
Then there is cybercrime. Poorly protected CNI devices may be used to gain entry to computer networks with more value to criminals. In some cases, devices could be recruited to botnets. Again, this is already thought to have happened with IoT devices. Others may be direct targets, for example tampering with electricity meters or stealing data from point-of-sale (PoS) devices that are the ultimate front end of many retail supply chains.
Who is ultimately responsible for CNI security? Should it be governments? After all, many of us own the homes we live in, but we expect governments to run defense forces to protect our property from foreign invaders. Governments also pass down security legislation, for example at airports, and other mandates are emerging with regards to CNI. However, at the end of the day it is in the interests of CNI providers to protect their own networks, for commercial reasons as well as in the interests of security. So what can be done?
Securing CNI
One answer is, of course, CNI network isolation. However, this is simply not practical. Laying private communications networks is expensive and innovations like smart metering are only practical because existing communications technology standards and networks can be used. Of course, better security can be built into CNIs in the first place, but this will take time. Many have essential components that were installed decades ago.
A starting point would be better visibility of the overall network in the first place, and the ability to collect inputs from devices and record events occurring across CNI networks. If this sounds like a kind of SIEM (security information and event management) system, along the lines of those provided for IT networks by LogRhythm, HP, McAfee, IBM and others, then that is because it is; a mega-SIEM for the huge scale of CNI networks. This is the vision behind ViaSat’s Critical Infrastructure Protection. ViaSat is now extending sales of the service from USA to Europe.
The service involves installing monitors and sensors across CNI networks, setting base lines for known normal operations, and looking for the absence of the usual and the presence of the unusual. ViaSat can manage the service for its customers out of its own security operations center (SOC) or provide customers with their own management tools. Sensors are interconnected across an encrypted, IP fabric, which allows for secure transmission of results and commands to and from the SOC. Where possible the CNI’s own fabric is used for communications, but if necessary this can be supplemented with internet communications; in other words, the internet can be recruited to help protect CNI as well as attack it.
Having better visibility of any network not only helps improve security, but enables other improvements to be made through better operational intelligence. ViaSat says it is already doing this for its customers. The story sounds similar to one told in a recent Quocirca research report, Masters of Machines that was sponsored by Splunk. Splunk’s background is SIEM and IT operational intelligence, which, as the report shows, is increasingly being used to provide better commercial insight into IT-driven business processes.
As it happens, ViaSat already uses Splunk as a component of its SOC architecture. However, Splunk has ambitions in the CNI space too. Some of it customers are already using its products to monitor and report on industrial systems. Some co-opetition will surely be good thing, as the owners of CNIs seek to run and secure them better for the benefit of their customers and in the interests of national security.