How to Ensure Reliable Protection for Critical Infrastructure

What is critical infrastructure?

In the United States, critical infrastructure describes the systems, both physical and digital, that are essential for maintaining society. It includes facilities, systems and services whose failure would have serious consequences to our physical or economic health.

The following sectors are part of the U.S. critical infrastructure:

• Chemicals
• Commercial facilities
• Communication
• Critical manufacturing
• Dams
• Defense industry
• Emergency services
• Energy
• Financial services
• Food and agriculture
• Government
• Healthcare and public health
• Information technology
• Nuclear reactors
• Transportation systems
• Water and wastewater systems

These sectors are essential services. They are crucial for economic security, public safety and the well-being of the population. However, they can be exposed to threats – such as cyberattacks, sabotage or terrorism. This makes their resilience and security a top priority.

Critical Infrastructure and the Government

The United States government is active in its efforts to protect the nation’s critical infrastructure.

Federal Government Roles and Responsibilities

There are two primary government entities tasked with securing critical infrastructure safety. These are the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of National Cyber Director (ONCD).

The ONCD guides the President in establishing policies and strategies related to cybersecurity. The most recently released was the National Cybersecurity Strategy 2023.

CISA is organized under the direction of The Department of Homeland Security. This agency works with both public and private teams. It helps protect critical infrastructure from a wide variety of threats. Threats is a broad term used to describe natural disasters, cyberattacks, chemical misuse and more.

CISA partners with the public-private sector and focuses on:

• Supporting companies in developing the tools and resources to keep themselves safe,
• Implementing risk management frameworks,
• Coordinating responses to large-scale events, and
• Providing support for federal public event security and public health emergencies

The two entities are aided by the Federal Bureau of Investigation (FBI). The FBI focuses on counterintelligence activities and law enforcement.

National Cybersecurity Strategy 2023

Most recently, the President of the United States released the National Cybersecurity Strategy 2023. This document outlines strategy objectives to help operationalize cybersecurity efforts by critical infrastructure owners and operators in the United States. Among other topics, the document suggests:

• Establishment of cybersecurity regulations
• Promote economic pathways for businesses to implement cybersecurity regulations
• Enhance the ability of CISA and sector-specific agencies, known as Sector Risk Management Agencies (SRMAs). These should be more proactive and further collaborate with the private sector.
• Continue to improve knowledge sharing and coordination among agencies
• Modernize and replace systems that are no longer secure

How can critical infrastructure be protected?

Operators of critical infrastructure have a special responsibility. They must be accountable for a company’s health and a pillar for the general welfare of the population.

To accomplish this, they should:

1. Implement measures for protection
2. Take precautions to avoid disruptions, and
3. Plan consequential responses in the event of an emergency.

Securing the Critical Infrastructure

In order to protect critical infrastructure effectively – from attacks, sabotage or terrorism – precision and care are required. Owners and operators must take holistic and multidisciplinary approaches.

These approaches prove to be beneficial:

• Risk analysis: identifying and assessing risks and potential vulnerabilities is an important first step. This includes identifying potential threats such as cyber-attacks or acts of sabotage. The goal here is to understand and evaluate all serious potential consequences.
• Evaluate security: In addition to risks, the focus is also on current security measures. Specifically, companies and organizations should evaluate which potential vulnerabilities and possible points of attack exist.
• Expand cyber security: Physical precautions, such as fences, access controls or surveillance systems, require special attention. However, it is currently even more important to protect yourself effectively against cyber-attacks. This includes regular updates, encryption, reinforced firewalls, employee training and investing in new, up-to-date solutions.
• Maintain cooperation: Protecting critical infrastructure often requires close cooperation between companies, organizations, authorities and other stakeholders. Partnerships and regular exchanges allow potential threats to be identified more quickly and reliably and defended against more effectively.
• Implement early warning systems: In critical infrastructure, problems are ideally solved before they occur. Effective warning systems that provide early warning of irregularities, problems and disruptions are therefore all the more important.
• Appropriate emergency response plans: Emergency plans should be in place. These help companies react quickly and effectively in the event of failures, disruptions or attacks. If a critical case has already occurred, the actions must be well thought out, coordinated, clear and immediate.

The role of an Information Security Management System (ISMS)

Implementing an ISMS is worth considering for critical infrastructure operators. The control systems guarantee that the latest standards are being followed. They also ensure that comprehensive IT security is in place.

In general, it establishes a series of procedures and rules. These are used to manage, monitor, maintain and improve information security on a permanent basis. ISO/IEC 27001 standards offer a holistic perspective on what is important here. They define the components and type of use of such a system.

To mitigate risks and protect relevant data, certain steps – known as ISMS controls – are necessary. A simple example control might be using of anti-virus software.

How ISMS Software Works

Ensuring comprehensive information security and recording all the steps taken quickly becomes confusing, time-consuming and chaotic. It is also difficult to assign responsibility for all the necessary documentation correctly.

An ISMS software solution speeds up risk management and ensures that all documents are kept up-to-date. This benefits companies by providing:

• a better overview,
• more rapid responses,
• up-to-date information, and
• simplified stakeholder communication.

Best Practices for Protecting Critical Infrastructure

Critical infrastructure is a sensitive and very crucial issue. To date, voluntary efforts from the private sector, in collaboration with federal agencies, have proven useful. Companies that are just getting started with – or are looking to improve – their security efforts will benefit from the following best practices.

Tip #1: Practice effective escalation management

Escalation management holds the key to solving problems quickly and effectively. By moving cases up the hierarchy, companies ensure that the people with the right skills are put to work. Reliable problem solutions can be created at speed.

This principle can be adapted to critical infrastructure. Companies can escalate incidents or address security gaps in a targeted manner.

Tip #2: Implement adequate risk management

GRC factors (governance, risks, compliance) are very important. Governance describes the management of data and information; risks are about minimizing them; and compliance is about legal certainty.

Adequate risk management prevents data silos from arising. It stops risks from being insufficiently recorded and actions from being taken late – or not at all. By centrally and securely identifying and analyzing all relevant data and risks, critical infrastructure can be protected in a targeted and reliable manner. This allows operators to take the right measures at the right time.

Tip #3: Carry out regular audits

It goes without saying that the software and systems used must function reliably. The principle of control is deeply related to critical infrastructure. It is important that every system or process used is subject to a regular audit. This ensures reliable operation in accordance with requirements.

Tip #4: Identify vulnerabilities proactively

Reacting to an incident is great, but by that time, it’s too late. This should be avoided, especially in critical infrastructure.

The best protection is to simulate an emergency and make improvements based on this if necessary. For example, collaboration with ethical hackers helps to identify and eliminate critical vulnerabilities and to develop the best possible security. CISA also offers exercises that teams can use to proactively plan find gaps in their security planning.

Tip #5: Develop an efficient incident management system

Incident management is about responding to incidents and faults quickly, appropriately and in a structured manner. This allows them to be resolved as quickly as possible. It helps functionalities be restored in order to safeguard operational processes.

Owners and operators should perfect their incident management activities as much as possible. They should use the right software solutions for this. After all, top-class incident response is crucial in an emergency.

Conclusion: The Right Steps Count

Critical infrastructure refers to sectors, facilities and companies that are crucial for the smooth functioning of society. A failure in a critical infrastructure sector can have devastating consequences and can endanger public life.

Operators should be subject to a high level of responsibility, which goes hand in hand with corresponding protection obligations. This is because threats today are multifaceted and manifest themselves in both physical and cyber forms.

Generally speaking, security cannot be high enough, so multidisciplinary measures and collaboration among agencies, businesses and the government are necessary. Particular attention must be paid to information security and to rapid responses in the event of disruptions or attacks.

The right steps, adherence to best practices and, above all, the use of modern software solutions guarantee comprehensive protection.

Find out how OTRS can provide proper support for critical infrastructure.