How critical infrastructures can be protected against cyber attacks

Critical infrastructures targeted by cyber attacks & pressured by regulations 

In most countries, in the European Union, Australia or the USA, for example, critical infrastructures have been defined by law and considered vital for the basic supply of a country. So crucial that their decommissioning or destruction would have a weakening effect on safety, economic security and public health. The following sectors are unanimously considered to be critical:  

• electricity and water supply
• information technology and communications
• healthcare
• finance
• transportation
• government, state and administration
  and some other country-specific sectors

 

Obligation to provide proof of functional IT security to critical infrastructures

Critical infrastructures have been the target of cyberattacks for some time, as current reports show:

           +++++++++++++++++++++++++++++++++     NEWS   +++++++++++++++++++++++++++++++++++

• A ransomware attack at the Brooklyn Hospital Center in New York hitting several computer systems  caused permanent loss of some patient's data.
• In December 2015, the world witnessed the first known power outage caused by a malicious cyber-attack. Three utilities companies in Ukraine were hit by BlackEnergy malware, leaving hundreds of thousands of homes without electricity for six hours.
• Polish national airline LOT grounded planes in June 2015 after its flight plan system was disabled by hackers in a Distributed Denial of Service (DDoS) attack. Weeks later in July, United Airlines grounded its fleet after suffering a technical fault. 

With the rise of cybercrime, operators of critical infrastructures must prove that their IT security measures are appropriate and "state of the art". The effectiveness of the IT measures must be proven through certification or audits. Attention: Not only critical infrastructure companies are affected, but also their suppliers. Larger clients usually expect certain security measures from their suppliers to be able to provide appropriate security evidence. 

 

Why are critical infrastructures particularly profitable for attackers?

• Society is dependent on the services of critical infrastructures. Their availability and quality have a high impact on a functioning polity.
  
  
• The critical sectors are interdependent, for example, power supply and information and telecommunications sectors. In the event of damage, there is a risk of a domino effect between the sectors.

What are the requirements regarding data processing and data security?

In the field of cyber security, critical infrastructures should cover the following considerations (source: German Guidelines on content and requirements for industry-specific security standards - B3S).
The USA regulations can be found at CISA, for Australia, details can be found here.