Five Hard Truths About Critical Infrastructure Protection

Email     |     Share  
1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | 12 | 13 | 14 | 15 | 16 | 17
Next Five Hard Truths About Critical Infrastructure Protection-3 Next

Air gaps continued

Air gaps and brittle, unpatched IT systems make a dangerous combination. Many asset owners, operators and regulators worldwide believe air gaps provide fail-safe protection against cyber attacks and APTs. The physical air gaps have thus fostered mental ones, an "it can't happen here" sense of invulnerability that can lead to negligent or even reckless behavior when it comes to cybersecurity.

The reason? Cyberattacks can pass through traditional safeguards – guards, guns and gates – like ghosts. Connectivity isn't just via a hard line anymore. Whether intentionally or hoodwinked through social engineering, authorized facility personnel can personally deliver the means of potential exploitation, either by physical device or wireless connection, past every air gap.

Once considered the unthinkable, real-life cyber attacks on critical infrastructure have taken center stage in the past three years. Advancing technologies, evolving cyber threats and a little piece of malware called Stuxnet have catapulted cybersecurity of real-world infrastructure from an academic backwater to a top government and industry priority. From power plants to water treatment sites to traffic control systems, critical infrastructure once thought invulnerable to targeted cyber attacks now lies squarely in the crosshairs.

Over the past two decades, asset owners and operators have added IT systems to help improve management of the ubiquitous industrial control systems (ICS) that perform essential mechanical functions of all kinds. These systems have led to improved service, lower costs and technological marvels such as smart grids. Unfortunately, they have also exposed critical infrastructure to software vulnerabilities that adversaries can exploit through malware and advanced persistent threats (APTs).

Critical infrastructure providers now find themselves in a harrowing position: They must protect both physical and digital assets, but often know less than their adversaries do about those assets' vulnerabilities and how to remediate them. The complexity of IT-enabled critical infrastructure has multiplied the difficulty of protecting it, as have the skyrocketing frequency, sophistication and severity of cyber attacks over the past ten years. Consequences for failure can be catastrophic, but finding the right resources to improve protection can be challenging and expensive – making the decision to invest in security a painful business dilemma.

To protect themselves and their stakeholders from escalating cyber threats, critical infrastructure owners must first acknowledge five hard truths, according to Raju Dodhiawala, vice president and general manager at ManTech.


Related Topics : Unisys, Stimulus Package, Security Breaches, Symantec, Electronic Surveillance

More Slideshows

Social14-190x128.jpg 10 Ways to Improve Your Social Media Security Policy and Posture

When phone calls, video conference information, pictures, chat logs, etc. are all stored in a central location via social media, a potential hacker has access to just about everything, quickly and easily. ...  More >>

Security120-290x195 5 DDoS Myths Debunked

Unearth the real story behind five commonly held myths about distributed denial-of-service attacks. ...  More >>

Security119-190x128 8 Tips for Ensuring Employee Security Compliance

IT security ultimately depends on making sure employees use the appropriate tools and comply with policies designed to protect them and their data/applications. ...  More >>

Subscribe to our Newsletters

Sign up now and get the best business technology insights direct to your inbox.