The Impact of Cyber-Physical Threats on Critical National Infrastructure (CNI)

The summary of the Microsoft Digital Defense Report 2022 reveals the ferocity of threats – the volume of password attacks has risen to an estimated 921 attacks every second; a 74% increase in just a year, and 93% of ransomware incident response engagements showed insufficient controls on privilege access and lateral movement.

The modern industrial network, especially those of critical infrastructure sectors is more interconnected than ever before. Industry experts define such environment as the Extended Internet of Things (XIoT): an ever-growing web of connected devices that span and support cyber-physical systems and range from both legacy and greenfield OT (operational technology) assets to IT (information technology) and IoT (Internet of Things) devices, to building management system equipment. The use of XIoT devices has grown year-over-year, in addition to traditional OT manufacturing devices.

Further, the rapid adoption of internet-facing devices of all kinds as a component (read cyber-physical systems) of accelerating digital transformation has increased the attack surface of our digital world. Securing these cyber-physical systems has become the biggest challenge. While the security pertaining to IT hardware and software has strengthened in recent years, the security of IoT and OT devices security has not kept pace. Threat actors exploit these devices to access networks and enable lateral movement, establish a foothold in a supply chain, or disrupt the target organization’s OT operations.

The National Institute of Standards and Technology (NIST), U.S., defines critical infrastructure as “systems and assets, whether physical or virtual, so vital to the country that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety or any combination of those matters.”

In recent years the security risk to critical infrastructure has grown manifold as digital integrations in legacy environments have opened these facilities up to attack. The number of attacks launched on critical infrastructure by nation-state groups doubled in the past year.

Attacks like the one on Colonial Pipeline, U.S. showed the potential payoffs to criminals for executing such a large-scale, impactful attack – the pipeline had to shut down.

A study in 2022 by Commtel Networks and Critical Future, U.K., highlighted the need for organizations to have robust policies in place to manage cyber threats and upgrade their cyber-physical defense.

• According to data from the Repository of Industrial Security Incidents, the transportation industry is the most targeted, followed by power and utilities, petroleum, and water/wastewater.

• Cost of a single data breach in the energy sector is $6 million.

• Each 1% improvement in the overall level of cybersecurity can lead to an additional $36 billion in economic growth from the transport, storage, and communication industries alone. Further, a key finding of the report is that an increase of $16 billion in energy investments is possible by implementing incremental improvements.

The cyber-physical security (CPS) systems guard against major economic disruption and even threats to human life. Therefore, it is critical for CNIs to consider their ability to maintain continuity of service while concurrently responding to a threat and minimizing the effect of a security breach.

An integrated cyber-physical security solution: By integrating data from all systems and assessing facility threat, safety performance, and failure prediction, organizations can improve their cyber-physical defense and unlock economic value.

As the world is increasingly dependent on CNIs viz. water, power, and utilities, it is crucial for organizations to prioritize cyber-physical security to ensure the safety and well-being of citizens. Further, for a country to harness the power of digital technologies, a corresponding level of security needs to be in place.

Author: Girish Dev - Head Artificial Intelligence & Digital Transformation (AI & DT)