Armoring Our Critical Infrastructure Against Cyber Attack

Cyber attacks or hacks of major U.S. companies and government offices for profit or gain have become all but routine. Banks and other financial institutions are regularly attacked for the most obvious reason; that is where the money is. Health care companies and major retailers are mined for the personal information they hold on tens of millions of individuals. Sometimes attackers use ransomware to extort money from these companies. Entire sectors of the economy such as pharmaceuticals, aerospace and defense are under constant assault for their cutting-edge intellectual property. Government networks and data bases are primary targets for hostile regimes seeking to acquire national security secrets. The former head of the NSA, General Keith Alexander, characterized the loss of U.S. intellectual property and economic information through cyber espionage as the “greatest transfer of wealth in history.”

Cyber weapons also allow nations to undertake destructive attacks that would constitute acts of war if performed with traditional military means. Cyber weapons also may offer the opportunity to strike certain targets that are heavily defended or otherwise immune to conventional attack. In 2003, the United States and a coalition of nations went to war with Iraq in order to eliminate that country’s alleged programs to develop weapons of mass destruction.  In 2011, a computer weapon known as Stuxnet allegedly built by an American-Israeli team was employed to cause hundreds of Iran’s nuclear centrifuges to spin too fast and tear themselves apart.

In war, critical infrastructure will be subject to different kinds of cyber attacks intended not to extract money, information and ideas, but to interfere with their performance or even shut them down. The goal will be to do with cyber attacks what in prior wars could only be accomplished by direct kinetic attack: cripple a nation’s ability to defend itself or its allies.

The Department of Homeland Security (DHS) identifies 16 critical infrastructure sectors for which it is responsible, ranging from government facilities to food and agriculture, financial services, water and wastewater, information technology, transportation and manufacturing. Defense installations are really a 17^th sector but they are not within the scope of DHS’s responsibilities. Not all facilities that would fit under a particular category are considered equally critical nor are all the sectors equally important.  In war, the most critical sectors other than government/defense facilities, would be the defense industrial base, transportation and energy.

There is a subset of the 16 sectors that are both critical to the functioning of the United States in peace and war and also particularly dependent on computers and networks that are, at least in principle, inherently vulnerable to cyber attacks. These include manufacturing, transportation, water and wastewater, nuclear power, dams and, most of all, energy. The last of these constitutes the most important target because virtually all the others are dependent on reliable supplies of energy to function. Take out the electric power grid, the system that produces, moves and delivers electric power to homes, businesses and government facilities, and the nation is immediately back in the Stone Age. Lest one think that such an attack is not possible, in December, 2015 hackers believed to be employed by the Russian government took control of and temporarily shut down Ukraine’s electric power grid. The attack employed a phishing e-mail to deploy malware throughout the grid’s management network.

Protecting critical infrastructure, particularly those that employ supervisory control and data acquisition (SCADA) systems to operate and direct devices, is extremely challenging. There are lots of ways to breach networks in order to go after specific devices or systems. The more devices and users are on a network, the greater the vulnerability. Moreover, most infrastructure is only as secure as its weakest link, which often turns out to be e-mail systems not even directly connected to the SCADA devices. The Stuxnet virus allegedly entered the Iranian centrifuges through the Microsoft Windows operating system and networks, then sought out the Siemens Step 7 SCADA software. Electric power grids are particularly vulnerable to attack because they are so complex with endless potential entry points from smart meters, to local distribution networks through transmission systems, ending with the SCADA device that manages power generation and distribution.

Finally, a technology has been developed that can reliably defend SCADA systems against a “Stuxnet threat.”  Created by Sierra Nevada Corporation, it is called Binary Armor. This is a device that sits between the SCADA system and all external networks. Binary Armor analyzes messages being sent to the SCADA machines at a byte-by-byte level, allowing only valid commands that are within the normal operating parameters of the system to go forward. If Iran’s nuclear weapons program had employed Binary Armor, the defense would have rejected the virus’s command to accelerate the centrifuge motors.

Binary Armor can be installed at multiple points in the power grid, wherever there is a SCADA device. Because each these devices employ rule sets configured to match the operating logic of the particular SCADA they are deployed to defend, there can be multiple layers of protection. If these rule sets need to be reconfigured, a Binary Armor box is reprogrammed offline and then physically inserted into the network at the appropriate point. Thus, the Binary Armor device acts as a virtual air gap, protecting the operating machines from malicious events while still allowing normal, legitimate communications between them and the network.

Binary Armor is not the answer to all the potential cyber threats to critical infrastructure. There are lots of reasons to invest in Binary Armor along with a full range of next generation security software to protect critical information, ensure privacy and prevent loss of revenues. But for the first time, critical infrastructure that is dependent on computers and networks can be armored against the kind of threat that could destroy them or, in the case of the electric power grid, turn out the lights.