Posted on Friday, December 22nd, 2017 in Cyber

Critical infrastructures are absolutely vital for our safety, security and prosperity. From gas and electricity to telecom and transportation; these networks are essential for the functioning of our daily lives. Recent cases however have illustrated that the cyber security of these critical infrastructures (CIs) is seriously at risk. Data leakages, malware attacks and misconfigured security systems are unfortunately much more common than they should be. These issues pose a serious threat to the infrastructures that structure our economies. Although CI owners have been slow to patch network vulnerabilities in the past, leaked data from companies such as Dell, Oracle and Texas Instruments makes it abundantly clear that serious cyber security measures need to be taken [1].

Cyber security critical infrastructures
SCADA industrial system. Source: Shutterstock

Data breaches can have several different causes, ranging from malicious actors that are purposely attempting to exploit a vulnerability, to accidental mishaps stemming from a lack of IT maintenance. In fact, 70% to 99% of data breaches result from internal flaws in IT systems, rather than coordinated hacks and attacks [1]. No matter what the reason behind them is, data breaches can have serious consequences and put people’s safety and security at risk; especially when they evolve into further cascading breaches. When sensitive information falls into the wrong hands, critical infrastructure systems can be affected in numerous ways. In several cases, entire industrial control systems and power grids were turned off, whereas in other cases, attackers were able to inflict physical damage on the infrastructures, after targeting faulty safety mechanisms. The attack on Ukraine’s power grid in 2015 and Iran’s nuclear enrichment facilities in 2010 both illustrate that any critical infrastructure company that is connected to the internet, could potentially be the next victim [2]. One of the biggest issues is that our institutions are heavily dependent on critical infrastructures: when hospitals and other public services are disconnected from power and gas, lives are at risk. Yet as attacks in Iran and Australia have shown, equipment can be manipulated by attackers, leading to entire sewage systems, nuclear plants and energy grids being shut down.

Hackers are able to get into these systems through a variety of different methods, including flawed password management by employees, exploiting memory corruption vulnerabilities, or installing malware that corrupts the rest of the system. In a recent data exposure in Texas, the United States, sensitive data was obtained without any form of hacking at play. Due to a simple security vulnerability, internet users were able to find top-secret information about risk analyses of critical infrastructures. The documents that anyone would have been able to access, revealed sensitive information about the physical locations of weak spots in various networks. Whether sensitive information is found and obtained through cyber attacks or ‘stumbled upon’ by individuals without any malicious intent: it is clear that any and all data leakages need to be prevented, and that critical infrastructure owners in particular need to be aware of the cyber security risks that they face. Although CI owners are known to have been slow in their response to cyber threats in the past years, the surge in cyber attacks these past three years will hopefully change the way they look at cyber security.

Sources:

[1] https://www.upguard.com/breaches/data-leak-pqe

[2] http://www.businessinsider.com/critical-infrastructure-hack-vulnerability-issues-2017-12

[3] Header image: Shutterstock 515865325