In this interview today, Harsheet discusses the evolving threat landscape surrounding cyberattacks on critical infrastructure. He identifies sectors that rely on Operational Technology (OT), such as manufacturing, utilities, and healthcare, as particularly vulnerable to these threats. Even sectors not traditionally dependent on OT, like banking and telecommunications, are not immune, underscoring the widespread nature of the risk.
Harsheet also highlights several innovative strategies being deployed to protect these critical infrastructures, including the development of robust cybersecurity frameworks, fostering a culture of ongoing vigilance, and the integration of IT, OT, and IoT infrastructures. He emphasizes the importance of public-private collaboration in safeguarding these vital sectors, citing successful partnerships like the Information Sharing and Analysis Centre (ISAC) and the National Cybersecurity and Communications Integration Center (NCCIC).
In the unfortunate event of a cyberattack, Harsheet outlines the key priorities for incident response and recovery, focusing on immediate notification, escalation, and the activation of a well-prepared Incident Response Plan (IRP) to contain and eradicate threats. His insights provide a comprehensive view of the current challenges and the proactive measures being taken to protect critical infrastructure.
Harsheet, can you give us an overview of the current threat landscape regarding cyberattacks on critical infrastructure? Which sectors do you believe are most vulnerable?
Sectors utilizing Operational Technology are at risk. This includes industries like manufacturing, utilities, pharmaceuticals, healthcare, transportation, and defense. These sectors rely heavily on OT for the direct control and monitoring of physical processes, making them prime targets for cyber threats.
Even industries that may not depend on OT, such as banking, hospitality, education, and telecommunications, are vulnerable. Threat actors’ targeting these sectors emphasize the need for robust defenses and proactive measures to protect industrial control systems from exploitation.
What are some of the most innovative strategies or technologies being deployed today to protect critical infrastructure from cyber threats? How effective have they proven to be?
That is a great question and I am glad you asked. There are a few key strategies that the organizations are adopting:
#1 Developing solid cybersecurity frameworks and risk management practices
This involves implementing comprehensive security control frameworks based on industry standards like NIST or ISO.
#2 Fostering a culture of ongoing cybersecurity vigilance
The major threats are insider employees or staff working in these critical sectors. Well-trained employees can recognize and respond to potential threats, reducing the risk of breaches caused by phishing attacks, social engineering, or inadvertent misconfigurations.
#3 Integrating IT, OT, and IoT infrastructures
Organizations must embrace a collaborative cybersecurity approach to ensure that vulnerabilities in one area do not compromise the entire ecosystem. By aligning cybersecurity strategies across these domains, organizations can implement consistent policies, advanced threat detection, and real-time monitoring, creating a holistic defense mechanism.
How important is collaboration between the public and private sectors in safeguarding critical infrastructure? Can you share examples of successful collaborations that have made a difference?
Public Private partnership is one of the key strategies to safeguard critical infrastructure. . Through these partnerships, there is a facilitation of a team environment where two-way information sharing of critical threat information, risk mitigation, and other information and resources is quick and actionable.
Two examples of successful collaboration are:
- Information Sharing and Analysis Centre . This partnerships has been crucial in enhancing the sector’s resilience by providing timely information and coordinated responses to emerging threats, ultimately securing critical infrastructure.
- National Cybersecurity and Communications Integration Center): The NCCIC has successfully coordinated responses to major cyber threats, providing real-time threat intelligence, and facilitated incident response efforts across the United States.
In the event of a successful cyberattack on critical infrastructure, what should be the key priorities in the incident response and recovery process?
An incident response plan includes these steps:
Step 1: Escalate and Notify
Upon confirming the incident, the designated incident response team) should be immediately notified. Depending on the severity, the incident should be escalated to relevant stakeholders such as senior management, legal teams, or regulatory bodies.
Step 2: Activate an Incident Response Plan
With the IRP triggered, the incident response team should begin executing predefined procedures based on the incident type, ensuring proper containment, eradication, and recovery actions are taken.
