Attacks on healthcare<\/a>, meanwhile, can mean life or death. A ransomware attack on a hospital in Germany in September 2020 caused emergency care to be disrupted. It resulted in a police investigation into whether the attack caused the death of a patient. Although the investigation found that the hackers were not directly responsible, the incident goes to show how high the stakes can be.<\/p>\nCNI vulnerabilities<\/h3>\n There are a number of reasons that critical national infrastructure can be vulnerable to cyber threats.<\/p>\n
Digital transformation, for example, has expanded the cyber footprint of all industries, exacerbating dependence on technology and connectivity and widening the opportunity for attacks. But despite digital advancement in several areas, the continued use of legacy systems designed before cyber security was even an issue also contributes to susceptibility.<\/p>\n
Complexity of operations, including supply chains and the large number of stakeholders involved also increases vulnerability.\u00a0 Different equipment suppliers, software vendors, and third-party contractors can mean that control over third-party products and services is often weak. The complexity of the systems is often such that nobody has the holistic and detailed view required, and companies rely on outsourced services.<\/p>\n
And as is often the case in cyber security, human error is always dangerous. Utility companies, financial institutions and healthcare providers to name but a few all employ thousands of workers who have access to sensitive systems and information. These workers can inadvertently introduce vulnerabilities through phishing attacks, weak passwords, and other security lapses.<\/p>\n
In order to protect the energy sector against cyber attacks, it is vital to take a systemic approach and weave cyber security into daily business activities.<\/p>\n
What can CNI organisations do to better protect themselves?<\/h3>\n Although vulnerabilities proliferate, there are a number of things that CNI organisations can do in order to protect themselves and the services they provide.<\/p>\n
The first is to plan for a cybersecurity budget and invest in exercises that help leaders and employees prepare for cyber security attacks. Implementing a zero trust policy, for example, where inherent trust in the network is removed, the network is assumed hostile and each request is verified based on an access policy.<\/p>\n
By hardening systems and investing in the human link by involving everyone to create a \u2018human firewall\u2019 it is possible to go some way towards preventing mistakes which lead to vulnerabilities, as well as ensuring planning and preparedness so that, should a cyber attack occur, it can be dealt with and contained as quickly and effectively as possible.<\/p>\n
Many examples of live exercises can be carried out that are enlightening for an organisation regarding their cyber security awareness and result in a whole set of measures to implement.<\/p>\n
Knowing how the internal network is built up for example, or how easy it is to cause lateral movement which allows a ransomware attack to really get to the heart of the company, and how it can be prevented.<\/p>\n
Moreover, it is crucial to:<\/p>\n
\nDecide who to call in a cyber attack;<\/li>\n Define the management\u2019s role;<\/li>\n Plan whether or not to inform customers;<\/li>\n Know where to back up and how to back up; and<\/li>\n How backups can be used after they have been decrypted.<\/li>\n<\/ul>\nCyber range technology can provide a realistic simulation environment for training employees on cyber security best practices, including identifying and responding to cyber threats.<\/p>\n
Cyber ranges can also be used to create simulations of cyber attacks on critical national infrastructure systems to help identify vulnerabilities, test cyber defences, and facilitate collaboration and coordination between different departments and stakeholders within a company. Being able to document the results of these simulation events also goes a long way towards the compliance required by many national regulators.<\/p>\n
It\u2019s not possible to protect everything, however, so we recommend prioritising. This means understanding what and where the organisation\u2019s crown jewels are, defending those, and detaching critical core systems from business systems to do so.<\/p>\n
Sadly it is the way of the world that if bad actors can pinpoint a way in which they can be harmful, causing data or financial loss, or reputation damage, then they will use it to their advantage.<\/p>\n
We have seen the devastation that attacks against critical national infrastructure can cause. Because of the way in which it underpins so many important national services, it will remain a prime target. Arming individuals with the knowledge and training in cyber security will be crucial if we are to protect our critical national infrastructure, keep vital services up and running and instil trust in the end-user.<\/p>\n","protected":false},"excerpt":{"rendered":"
Discover how industries must protect themselves against the growing threat of cyber attacks on critical national infrastructure.<\/p>\n","protected":false},"author":22,"featured_media":33237,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[830],"tags":[530,885],"acf":[],"yoast_head":"\n
How can we protect critical national infrastructure from cyber attacks?<\/title>\n \n \n \n \n \n \n \n \n \n \n \n \n \n\t \n\t \n\t \n \n \n \n \n \n\t \n\t \n\t \n