Since the current U.S. war with Iran started on Feb. 28, the most pressing security questions stemming from the conflict have focused on economic concerns — the closure of the Strait of Hormuz and its effect on global energy supplies and oil prices — as well as attacks on American military bases and personnel in the Middle East.
While concerns over cybersecurity haven’t been raised to the same level, the war has increased scrutiny of vulnerabilities in U.S. critical infrastructure, especially as Iran is known to have an active offensive cyber program and has improved its capabilities for over a decade. A few months after the first shots were fired, reports surfaced that attackers associated with Iran’s government had begun targeting water treatment facilities in the Midwest and other locations.
While nation-state groups are one concern, other reports have focused on ongoing U.S. critical infrastructure vulnerabilities and a lack of preparedness for what threat actors or cybercriminals might target.
U.S. critical infrastructure includes 16 separate sectors across the country, and efforts to prevent cybersecurity incidents and bolster security around often old and outdated technologies have typically been fragmented and uneven. What’s more, with anywhere from 50 to 85 percent of these facilities in the hands of private businesses, public-private partnerships are critical to security but are often ineffective.
Consider some recent developments that highlight the concerns of securing vulnerable critical infrastructure:
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) reportedly began scaling back six free cybersecurity assessments for critical infrastructure organizations, as well as other services, amid staff and budget cuts.
- At the same time, a National Association of State Chief Information Officers report found that state-level agencies are increasingly responsible for cybersecurity and must handle it with limited staffing and resources.
- The same report found that 90 percent of state CISOs believe that cyber incidents targeting critical infrastructure, including hospitals, water treatment and energy facilities, are a major issue.
- A report published by Honeywell Technologies found a gap in operational technology (OT) security readiness, with only one in five organizations reporting complete visibility into their OT assets, which are critical to the day-to-day operation of many critical infrastructure facilities.
Cybersecurity experts note that critical infrastructure and the OT systems that underpin it face several problems when it comes to countering modern threats, including those involving artificial intelligence.
In OT and critical infrastructure, the current pace of remediation is slow since maintenance and downtime must be carefully managed, coordination between devices and applications can be tedious, and the cost of the device not coming back online can be enormous, said John Gallagher, vice president at security firm Viakoo.
“Without more concrete and focused plans, and budget to implement them, it is hard to imagine up-levelling OT and critical infrastructure teams within the next few months to address the velocity and volume of AI-driven threats,” Gallagher told Dice. “The only viable countermeasure to the AI-driven threats highlighted here is automated, scalable cyber hygiene and remediation across all types of connected assets. Funding and training should urgently be focused in this area.”
For cybersecurity professionals working in critical infrastructure or looking to break in, understanding these challenges can strengthen skill sets and improve the ability to secure some of the nation’s most important facilities during challenging times and amid rising vulnerabilities.
Cybersecurity Challenges in Critical Infrastructure
For years, critical infrastructure networks have remained attractive targets to cybercriminals and nation-state groups for several reasons.
Mayuresh Dani, security research manager at Qualys, agreed with Gallagher’s assessment that downtime at these critical infrastructure facilities is not feasible because of demand, which makes security maintenance and patching difficult, especially as attacks accelerate.
At the same time, the recent federal pullback in cybersecurity resources and uncertainty around programs such as CISA’s State and Local Cybersecurity Grant Program (SLCGP) leave these facilities, and the communities they serve, more vulnerable to potential attacks and disruptions.
“Under-resourcing translates to an absence of endpoint patching, multi-factor authentication and backup tooling that is essential as a first line of defense against these attacks,” Dani told Dice. “Important initiatives, such as MS-ISAC/EI-ISAC, the free threat intelligence and incident response services, are also no longer affordable to these organizations. With an increase in AI-enabled vulnerability discovery, these issues will only be exacerbated.”
With many OT systems remaining internet-facing, poorly segmented and inadequately monitored, cybersecurity professionals working in these fields, or looking to get started, need to offer organizations more modern approaches, including using zero trust principles, microsegmentation and other methods, said Louis Eichenbaum, federal CTO at ColorTokens.
“This is exactly why the cybersecurity conversation must move beyond prevention alone. We are never going to patch fast enough or prevent every intrusion. The focus now must be on resilience, assuming an adversary may gain access and ensuring they cannot move laterally or manipulate critical operations at scale,” Eichenbaum told Dice. “Granular microsegmentation and zero trust principles are essential in OT environments because they help contain breaches, restrict unauthorized communications, and reduce the blast radius when a compromise occurs. The goal is not simply to stop every attack, but to ensure that a localized intrusion does not become a catastrophic operational event.”
Another issue that recent events have brought back to the surface is the long lifespan of devices used in critical infrastructure facilities. Technology that had been designed and tested to the best practices available when it was released can easily become vulnerable to attacks using more sophisticated, modern attack methods, said Tim Mackey, head of software supply chain risk strategy at Black Duck.
“Since attackers know that critical infrastructure and manufacturing providers are measured in their uptime or service availability, once a device is compromised, attackers know that they have the luxury of mapping out and planning a very targeted attack rather than just being opportunistic,” Mackey told Dice.
Developing Cyber Skills for Critical Infrastructure
An ongoing issue with cybersecurity within the critical infrastructure space is that many of these systems are managed by generalists who lack specific expertise in OT systems, Qualys’ Dani noted.
“From a skills and response point of view, these networks are generally managed by do-it-all professionals without certain expertise. This itself is a resource constraint and a dependency,” Dani added. “These networks normally have a flat, non-hierarchical setup, translating to a ‘compromise one room, get access to all other rooms’ scenario. This also means sensitive data about a large population can be easily grabbed, which is attractive for extortion leverage and resale.”
When it comes to hardening defenses in critical infrastructure and especially OT environments, several experts noted that cybersecurity professionals must focus on zero trust principles to help build additional security layers.
“Understanding the convergence between IT and OT is so critical and a zero trust architecture excels in OT. Because OT environments cannot leverage modern security controls, it is imperative that these environments embrace zero trust architecture to create a security boundary for access both from the public web and internal access,” Christopher Hills, chief security strategist at BeyondTrust, told Dice. “This is a step in the right direction to create a buffer and gate any inbound and outbound access due to an OT environment's lack of security controls. Obviously, ensuring default logins and passwords should already be a layer and managed or rotated, and any public-facing, direct access should be turned off.”
Hills added that some of the recent attention paid to the country’s critical infrastructure and cybersecurity will help, but that these industries need cyber talent and resources to help modernize technology to counter modern threats.
“Threat actors already know our weakest infrastructure is our critical infrastructure, whether it be in our utilities sector or other OT,” Hills noted. “If we do not find a way to modernize these legacy systems, put modern security controls in place, and guard them against attacks, we will continue to suffer and see breaches and compromises across OT environments.”
