Critical Infrastructure Protection against Cyber Threats

By Lior Tabansky
INSS – Cyber Warfare Program

.

Introduction

A functioning modern society depends on a complex tapestry of infrastructures: energy, communications, transportation, food, and many others. This article discusses the developing cyber threat to critical infrastructure while focusing on several dimensions: aspects to the threat that require an interdisciplinary approach; defense against the threat; the existing Israeli response; and the developing challenges. An informed public debate is likely to lead to improved protection of national infrastructures in the civilian and public sectors.

The article begins by defining the subject of critical infrastructures, and discusses the origins, uniqueness, and innovativeness of the threat to them. It then discusses levels of coping with the threat, using conceptual parallels to the world of military content. The existing Israeli response will be reviewed briefly, with an emphasis on the central challenges the cyber threat poses to public policy. Finally, directions for future research and action will be presented.

What are Critical Information Infrastructures

An infrastructure is a system that combines various facilities and enables certain activities, for example, a pipeline that conducts water from wells to homes and fields, paved roads, bridges and intersections that allow movement of people and goods, flight, communications, fuel, and health services. One of the properties of an infrastructure is the dependence of various spheres of activity on it. In the past, the dependence stemmed from physical or geographical relationships only. With the development of cyberspace,  which includes data communication systems and computerized methods of automatic command and control, there are additional relationships, which in turn create further vulnerability. These are computerized relationships (for example, command and control by remote electronic means) and logical relationships (such as the international financial market as a factor influencing inputs and outputs of critical infrastructures), which are innovations that would not exist without information technologies. It is therefore worth distinguishing between infrastructures in the traditional sense and the modern use of this concept, which includes a cyber dimension.

In the information age, traditional infrastructures become information infrastructures because they incorporate computers. In addition, new critical infrastructures have been created that are purely information infrastructures: computerized databases that contain important data, such as records of capital in the banking system, scientific and technical intellectual property, and the programmed logic that manages production processes and various business processes. In the information age, the concept of “infrastructure” also includes computerized components, and thus “infrastructure” today necessarily refers to an information infrastructure.

Infrastructure is defined as critical when it is believed that disrupting its function would lead to a significant socio-economic crisis with the potential to undermine the stability of a society and thereby cause political, strategic, and security consequences. Different countries have offered a variety of definitions of critical infrastructures.2   What all have in common is the existence of a computerized element upon which other physical systems are dependent and which, if harmed, would likely cause widespread damage in physical terms.

Three factors can define a critical infrastructure. The first is the symbolic importance of the infrastructure. Thus, several democratic countries include heritage sites, museums, archives, and monuments among critical infrastructures that should be protected from cyber threats. Another source of symbolic power is the perceived control of a government. For example, a hostile disruption of traditional media used by the state for communicating with its citizens will immediately harm the government’s ability to function. Moreover, in the longer term, such disruption may diminish the citizens’ confidence in the existing government, or even the general form of government or regime.

The second factor is the immediate dependence on infrastructure, such as the electricity grid or telecommunications network, which is obvious for most processes in society. The emergence and prevalence of cyberspace created a situation in which computerized networks constitute an infrastructure in and of themselves. Cyberspace is a representative example of an infrastructure that has become critical because of the interface of most of society’s activity with computerized communications networks.

The third factor involves complex dependencies. The accelerated trend toward adding connectivity capabilities enables unanticipated effects beyond the local level (the “butterfly effect”).   The relationships among various infrastructures are presumably not fully known, and the failure of one component is liable to cause a wide range of results and damage. The types of failure fall into three classes:

a.  Common cause failure. For example, various facilities (fuel storage, airports, and power stations) that are located in geographic proximity are likely to be harmed from a single incident of flooding. It is hard to imagine a cyber attack that would directly cause a failure of this type.

b.  Cascading failure. Disruption of a control system in one infrastructure (for example, water) leads to disruption of a second infrastructure (for example, in transportation, the flooding of a railway line), and then a third (for example, food supply chain) and so on, even if it is not directly dependent on it. A cyber attack could directly cause such a failure.

c.   Escalating failure. Disruption of one infrastructure (for example, a communications network) harms the effort to fix other infrastructures that have been damaged by another entity (emergency services, commerce).  A cyber attack could directly cause this type of failure. The commercial aviation sector, which has attracted the attention of

enemies of the developed states and prompted noticeable acts of hostility

– hijacking of commercial planes, the September 11 attacks, and other terrorist attacks using civilian airplanes – can illustrate the importance of critical infrastructures and the significance of an attack on them. Civil aviation is a basic infrastructure for developed societies: in 2009, commercial air transport carried more than 2 billion passengers on 28 million flights on 27,000 airplanes operating from 3,670 commercial airports around the world.   In addition to commercial flights, military aircraft (some unmanned) also populate the skies. Intra-state laws, regulations, and procedures, along with international cooperation, regulate the administrative aspect of the airline industry. Airports are connected to each other through scheduled air traffic, and the air traffic control system in each given location is part of the international aviation infrastructure. Air traffic control is based on computerized systems: methods of detection, monitoring, surveillance, automation, communications, command and control, and so on. Disrupting the proper functioning of air traffic control systems would harm all air traffic.

The Novelty of the Threat

Recent  years have brought increased concern  over the potential vulnerability of the infrastructures that are the basis of developed modern societies,  yet the fact that this discussion is taking place now is surprising. Critical infrastructures have always been critical and their importance is obvious. International and internal conflicts are not new to the world, and in war it is reasonable to anticipate attempts to harm the adversary’s critical infrastructures with the goal of weakening and defeating it. In 1917, during the Bolshevik Revolution, Lenin and Trotsky ordered their activists to take over the post office, telegraph systems, bridges, and train stations. In prolonged wars, such as the Second World War, attempts have been made to harm critical infrastructures in order to interfere with the enemy’s fighting ability and spirit.   A country’s critical infrastructures, whatever they are, are elemental targets during a conflict, and therefore organizations and states have labored throughout history over defense systems for their infrastructures: camouflage, guarding, fortification, defensive forces, deterrence, and so on. Why, then, is there a growing fear of damage to critical infrastructures, particularly in the strongest countries?

A critical infrastructure is a tempting target for an enemy, be it a terrorist organization or a hostile state. However, the developed countries currently enjoy total military superiority over their respective enemies. The US and Europe have not experienced wars on their territories in recent decades. Israel is the only developed country that is under ongoing military threat that is manifested in a variety of ways (missile attacks in 1991, rockets in the north and south of the country, and suicide bombers in 2000- directly attack the civilian population by circumventing the military that was supposed to protect it. The terrorist attacks could not threaten the countries attacked, but they did succeed in causing a change in their policy in one way or another.

In all forms of traditional warfare, the identity of the enemy is disclosed following the attack because in order for the attack to be carried out, the weapons must physically reach the target. In the event of a missile launch as well, there is no doubt as to the location of the launch site. The hijacking of commercial aircraft in the 1970s, the suicide bombings in Israeli population centers, the attacks in the United States in September 2001, and the attacks in Madrid in 2004 and London in 2005 all required the attackers to be physically present at of the attacks.

Identifying the enemy is critical for response and deterrence. Thus what prevented harm to critical infrastructures in the past was the defensive force placed in the path of the enemy, and even more so, the deterrence that promised to exact a heavy price. This familiar state of affairs came to an end with the development of cyberspace. For the first time in history, it is possible to attack strategic targets (such as critical infrastructures) without physically being in the place where they are located, without confronting defensive forces, and without exposure. In today’s reality, the existing computerized infrastructure can be exploited through penetration of communications networks or the software or hardware of the command and control computers in order to disrupt, paralyze, or even physically destroy a critical system.  The threat stems from the  vulnerability inherent in the properties of cyberspace, and because of these special characteristics, the cyber threat challenge differs fundamentally from the challenges of traditional threats.

Levels in Confronting the Threat

This article focuses on the cyber threat to the computerized part of the infrastructures, based on the realization that such a threat has become possible, available, significant, and is liable to disrupt the functioning of developed society.

Confronting the threat to critical information infrastructures includes prevention, deterrence, identification and discovery of the attack, response, crisis management, damage control, and a return to full function. When examining ways to confront threats to national security, the accepted practice is to divide the discussion into the tactical, operational, and strategic levels. Proposed here is a division of methods for confronting the threat to critical communications infrastructures into a number of levels: technological, technical-tactical, operational, and national-strategic.

The technical level focuses on an organization’s computerized system, which is the most common activity in this realm. Given the large volume of activity, the technical aspect of “information security” is often emphasized, though it is actually a concept that deals with both defense of critical infrastructures and cyber security in general. In addition, activity that examines the issue from a comprehensive national perspective, referred to below as the national level of cyber security, is underway.

All the levels are required to confront the threat, but given the different focus, it is worthwhile distinguishing between these levels of protection. The proposed division will help identify the essence of the challenges of protecting critical infrastructures particular to cyber security.

The Technical Levels: Tactical and Operational Levels

Since the threat is derived from the properties of computer technologies, the response to the threat is generally sought among computer experts. As expected, the proposed solutions are also based on computer technologies. The problem is perceived as a technical problem, and therefore, the proposed solution is an engineering solution. The technical and operational levels for confronting the cyber threat, which come from engineering, mathematics, and computers, focus on identifying vulnerabilities in an organization’s computerized systems and seek an engineering solution that reduces this vulnerability.

Table 1 displays common issues confronted by the technical levels of protection.

The primary means of attempting to build resilience  is to invest in backup, redundancy, air gap, and the like. Accordingly, important computer systems are built twice, in separate locations, in order to enable continued function in the event of physical damage to the system.

Today, most solutions to the engineering problems identified are implemented through the private market. Information security is a wide ranging field, and describing it is beyond the scope of this article. In the division proposed here, information security lies in the technical- operational levels. Information security is a developing discipline that brings together many resources for research and development, consulting services and outsourcing, a security product industry, and the like. The worldwide information security market is expected to grow, and some market analysts claim (perhaps with some exaggeration) it will reach $125 billion in 2015. Most of these revenues will go to US and European companies that offer combined solutions of technical goods and services, together with technological-business consulting.

The issue of cyber security, and especially of critical infrastructure protection, came about as a result of technological change. At first, it was expected that the solution to a problem of technical origin would be technical. However, there is a growing understanding that this problem cannot be dealt with on a technical-operational level only, since a precise engineering formula for dealing with the cyber threat is not possible: society’s structure, values, and institutions are integral parts of the environment.

The Top Level: The National Strategic Level

The national strategic level examines the threat to critical infrastructures in the framework of national security, with a national focus that goes beyond the boundaries of an organization or a business process. This approach sees the protection of critical information infrastructures as part of the protection of society as a whole. Protection of information infrastructures actually becomes protection of an information-based society.17 Information security, which is at the center of the technical level, is a necessary but by itself insufficient part of the strategic vision. The highest national level is based on technical and operational foundations, but in a broader approach it is not sufficient to fix local problems of organizational systems. As in the military, the strategic level needs an appropriate operational level, but this is not sufficient to achieve the strategic goal.

In a wider national perspective, a comprehensive national policy on protecting critical infrastructures is needed, which in addition to the engineering foundations will take into account the complex social, political, economic, and organizational aspects. An organizational entity capable of taking into account the complex of relationships between critical infrastructures and a functional society and the state is also required. The national level of protection requires cross-organizational activities, backed by effective authority. Without a doubt, this is a complex challenge for public policy, considering the structural limitations of public service on the one hand and a required level of strategic focus of those in the private sector, on the other. Just as the state defends its entire physical space, it also sees an increasing need to protect cyberspace fully, in spite of its special characteristics, which make the task more difficult.

The information revolution continues to change the strategic environment, and it affects a range of social, cultural, and economic issues in complex ways. Cyber security, and in particular, protection of critical infrastructures, is already on the agenda. The development of cyber threats to a national security issue makes governments into the main customers of protection services. Even limited experience shows that there are differences in the framework of the discussion and the types of solutions proposed in different countries, in spite of the great similarity in the source of the threat. Since the threat is similar, the explanation for the differences must be the role social institutions play in the discussion and in determining the response. What follows are the main issues concerning cyber threats that call for a public debate.

Which infrastructure is critical? Any discussion on protection and defense measures must begin with prioritization. Assessing and measuring the level of the threat to components, computers, and systems is a necessary precondition for effectively confronting the threat. The exact sciences and engineering have mathematical methods for measuring the relationships and the dependence between components and the system. These tools are also used in the technical levels of protection of critical infrastructures. Nevertheless, more comprehensive methods are needed for assessing risks that stem from the intricate relationships among complex technological systems that critical infrastructures contain.

An assessment of how critical an infrastructure is on a national level must address the full matrix of social values, goals, and interests. Therefore, the relative importance of infrastructure and the amount of public investment needed to protect it are not derived from an engineering formula, and require a wide ranging and informed public discussion. Representative political institutions are the place for such a discussion in a democratic society. Given the constraints of the political system, such a discussion will presumably be lengthy and at times frustrating. Nevertheless, only through a joint political process will it be possible to design an optimal response to the threat for the long term.

Cyber vulnerability: technical issue, economic risk, or security threat? What is the potential significance of the growth of cyberspace in general, and the harm to critical cyber infrastructures in particular? The topic clearly goes beyond the scope of computers, engineering, and information security to the question of the role of the state in cyber protection of critical infrastructures. Is this task military, partially civilian, “homeland defense,” or civilian-commercial? The answer directly affects the solution proposed, and it has wide political, budgetary, and organizational consequences. Until recently, the common assumption was that this is mainly a technical issue, and the response therefore was placed in the hands of computer experts. Commercial companies provided technical solutions for the military, commercial, and civilian sector, and governments did not play a significant role. Today it is clear that the optimal answer can be found only in a joint discussion between various sectors in society because it is derived from the values of the society, its political and social structure, and its national security concept.

A political process for finding the balance between the values of freedom, market ideology, and security requirements: Critical infrastructures and the information necessary for their proper functioning affect all areas of a citizen’s life. They raise many issues that affect civil rights, such as privacy, confidentiality, and due process; the relative strength of the state, citizens, and corporations; and allocation of public funds. Therefore, the central challenge in designing a policy to protect critical infrastructures from cyber threats is not technical or operational, rather a challenge of a comprehensive national-strategic vision. Critical infrastructure protection is not the exclusive preserve of systems engineers and computer experts. The optimal response to the cyber threat in general and the threat to critical infrastructures in particular will be created only through a broad public discussion in the framework of a democratic political system.

The private market and cyber security: The cyber threat is affected by the decentralized nature of economic activity in an era of rapid technological change, globalization, and privatization. The global market economy has created the situation in which large parts of the critical infrastructures are privately owned.19 The unprecedented mutual dependence in international trade is one of the prominent expressions of globalization and privatization. The industrialized nations import most of the raw food that their citizens consume and export finished products and services. Food retailers do not keep inventory beyond several days’ worth of typical consumption, and they depend on the continued undisturbed function of the extensive logistical supply chain to satisfy demand within a short time.20  Given that disruptions in food supply would be a grave problem of wide social this supply chain could be perceived as a “critical information infrastructure” and become an urgent policy issue.