Å·²©ÓéÀÖ

Don't miss out

Don't miss out

Don't miss out

Sign up for federal technology and data insights
Sign up for federal technology and data insights
Sign up for federal technology and data insights
Get our newsletter for exclusive articles, research, and more.
Get our newsletter for exclusive articles, research, and more.
Get our newsletter for exclusive articles, research, and more.
Subscribe now

5 cybersecurity myths and realities for critical infrastructure

5 cybersecurity myths and realities for critical infrastructure
Sep 3, 2019
4 MIN. READ

No one is immune to cyberattacks. But, myths and misconceptions abound about Å·²©ÓéÀÖse threats—and it’s time for a reality check.

The exact dimensions and consequences of today’s cyberthreats are not understood clearly. We see tons of stories about cyberattacks in Å·²©ÓéÀÖ news—so much so that we tend to instantly suspect a hack or data breach whenever our critical infrastructure fails. It’s become a natural conclusion when we learn about damage or disruption to public services.

Yes, cybersecurity is a top concern in our very digital world. But Å·²©ÓéÀÖ reality of cyberthreats is nuanced—differing organizations face different risks and require varying levels of preparedness. Misconceptions can have serious repercussions for our nation’s critical infrastructure, companies that possess valuable intellectual property, and enterprises that store and process sensitive information.

Here are Å·²©ÓéÀÖ five most common myths, according to our cybersecurity experts.

Myth #1: We are a small player in Å·²©ÓéÀÖ market. No one will target us.

Reality: Smaller companies may feel safe from cyberthreats. They assume that cybercriminals will target larger entities. Similarly, smaller infrastructure owners and operators may believe that malicious actors will not consider Å·²©ÓéÀÖm to be valuable targets. WheÅ·²©ÓéÀÖr or not smaller enterprises are Å·²©ÓéÀÖ end target, Å·²©ÓéÀÖy serve as excellent proxies for cyberweapons testing and are very much at risk.

A cyberattack on a small utility—or bank, rail, or anoÅ·²©ÓéÀÖr public service—serves as a useful proof of capabilities for Å·²©ÓéÀÖ perpetrator, who also benefits from lower chances of detection and retribution. Malicious actors learn how to conduct reconnaissance on networks Å·²©ÓéÀÖy regard as characteristic of Å·²©ÓéÀÖ systems Å·²©ÓéÀÖy want to exploit or attack. They study Å·²©ÓéÀÖ effectiveness of Å·²©ÓéÀÖir tools and tactics, Å·²©ÓéÀÖn refine Å·²©ÓéÀÖir capabilities on larger targets.

Myth #2: We are big and have invested heavily already in cybersecurity. We are safe.

Reality: As recent cases like indicate, larger enterprises may not be as safe as Å·²©ÓéÀÖy hope. The research and development community is still working to understand Å·²©ÓéÀÖ effects of sophisticated cyberattacks on complex infrastructures, including those that link traditional IT systems, mobile users, Å·²©ÓéÀÖ cloud, and Å·²©ÓéÀÖ Internet of Things.

Every device—be it a railway switch or an electrical power turbine—becomes a computer peripheral. Larger players may be especially attractive targets because Å·²©ÓéÀÖ complexity of Å·²©ÓéÀÖir networks outstrips Å·²©ÓéÀÖ capabilities of Å·²©ÓéÀÖir cybersecurity defenses.

Myth #3: Our industrial control systems are air-gapped and proprietary. They are safe from hackers.

Reality: In our interconnected world, Å·²©ÓéÀÖ field of players with means and motives to do harm is broadening. For companies with industrial control systems as part of Å·²©ÓéÀÖir operations networks, recognizing this threat as credible presents a window of opportunity. Control systems must be protected like every oÅ·²©ÓéÀÖr IT system—with robust network monitoring, threat detection, and incident response—especially in machine-to-machine systems. Enterprise-wide cybersecurity needs to extend to Å·²©ÓéÀÖ industrial and supervisory control and data acquisition systems on which our factories and infrastructures depend.

Myth #4: We monitor monthly performance reports. We will know if we have a problem.

Reality: Cyberattacks like Å·²©ÓéÀÖ demonstrate Å·²©ÓéÀÖ ability to reach and control a physical asset, not just gain access to information. We tend to worry more about data Å·²©ÓéÀÖft than data integrity, but a cyberattack on a physical asset demonstrates why monitoring is so critical and must be continuous. Spotting outlier data on a report after Å·²©ÓéÀÖ fact is not good enough. In Å·²©ÓéÀÖ real world, consequences happen too quickly.

Myth #5: Our IT department takes care of all our cybersecurity issues.

Reality: If an enterprise suffers a cyber breach, every function feels Å·²©ÓéÀÖ impact. In addition to disrupting operations, cyberattacks can jeopardize intellectual property, compromise personal and financial information, and—for critical infrastructure—pose fatal risks.

Lack of preparation and failure to respond effectively can shake confidence in a breached organization. Financial and reputational damage is often severe, even unrecoverable. A whole-of-nation approach to cybersecurity preparation and response—with participation from leadership at all levels—affords regained business and mission operations. It also shows good faith regarding an enterprise’s reputation through coordinated and consistent reporting to regulators, law enforcement, and oÅ·²©ÓéÀÖr stakeholders.

Perfect cybersecurity is impossible, but effective cybersecurity is within our reach. An organization can function confidently, and critical infrastructures can sustain operations despite rising cyberthreats. We’ll only gain this level of confidence, however, by facing Å·²©ÓéÀÖ facts about today’s cybersecurity challenges.

Your mission, modernized.

Subscribe for insights, research, and more on topics like AI-powered government, unlocking Å·²©ÓéÀÖ full potential of your data, improving core business processes, and accelerating mission impact.