Should Trump Tackle Air-Gapped Critical Infrastructure?

Experts from the Massachusetts Institute of Technology and stakeholders from US critical infrastructure companies weighed in today with a host of recommendations for the Trump administration on how to take meaningful action to protect the nation's vital systems. In addition to the usual advice to quit delaying a decision, the experts' report took a stand by suggesting that critical components of the electrical grid and gas pipeline need to be taken offline.

The advice comes by way of a major report out from MIT's Internet Policy Research Initiative at the Computer Science Artificial Intelligence Laboratory. The report is the culmination of a year's worth of work reaching out to stakeholders across four major economic sectors: electricity, finance, communications, and oil and natural gas. Written by a group of luminaries headed by principal author Joel Brenner, a former inspector general for the National Security Agency, the report offers a handful of pointed recommendations to the president about how critical infrastructure security coordination needs to be expeditiously advanced.

As the Trump administration starts to float proposed executive actions in regard to improving federal cybersecurity, there's been very little said about bolstering the protection of privately owned critical infrastructure. The authors of the report warn that this could be to the country's great detriment. They say that coordinated improvement of national cybersecurity interests must include privately owned critical infrastructure if the US is going to make meaningful headway in improving the national risk posture.

"The nation can no longer afford a pattern of uncoordinated executive action and scattershot research," the authors say. "Total security is not achievable. But a materially improved security environment for the infrastructure on which virtually all economic and social activity depends can be created with sufficient resources and political will."

One of the biggest technical bones of contention the authors have regards the widespread access by critical control components of the US electrical grid and gas pipelines to the public Internet. The report states that security pros overwhelmingly believe at least certain aspects of their systems need to be air-gapped from public networks. The problem is deciding which aspects.

"There are significant differences of opinion about appropriate degrees of isolation," the authors admit. They recommend to the president that his administration expedite in coordination with the Federal Energy Regulatory Commission and the North American Electric Reliability Corporation, a conference of state electricity regulators, to "explore the feasibility and expense of isolating key elements of electricity generation and delivery from public networks."

It's an interesting debate because, in many instances, the industrial control system (ICS) environment is growing more connected to public networks than ever.

"It seems counterintuitive, this recommendation, because the myth of the air gap disappeared years ago," says Phil Neray, vice president of industrial cybersecurity for CyberX. "And it's getting even more unfeasible to do an air gap now when we're moving towards smart grids and smart manufacturing, when there's an even bigger need to connect the [operation technology] to the IT network in order to do analytics and real-time intelligence."

According to Lane Thames, software development engineer and security researcher with Tripwire's vulnerability and exposure research team, the security community must face these facts with planning that takes into account the convergence of the cloud, the industrial Internet, and the Internet of Things, which is already happening now. Companies are moving forward with it to not only improve the efficiency of the essential infrastructure but also to improve reliability.

"Newer industrial control systems will, indeed, have connections to the cloud for applications such as big data analytics and such. For example, predictive maintenance, which is key for advanced smart manufacturing, requires such technology," he explains. "These cloud-based applications will also come with communication paradigms that essentially break, as a minimum, our current standard views and best practices of security in terms of perimeters and segmentation."

These aren't trends that can easily be stemmed, and air-gapping systems with increasingly complex interconnections will not only be unrealistic from a business sense but also technically difficult to do. Neray says that there are better way of mitigating the risks, namely through continuous monitoring for anomalies and continuous assessment for vulnerabilities in critical systems, as well as improving information sharing between public and private sector stakeholders.

More Than Technology
Whatever the technical solutions look like, experts seem to agree that it will take more than just technological advancement to move forward on critical infrastructure security.

"The challenges we face are not merely technical. They are also economic, managerial, behavioral, political, and legal. Indeed, the technical challenges may be the easiest to address. For example, aligning economic, tax, and liability incentives with the goal of higher security is not a technical challenge," the report said. "Realigning incentives would be a daunting task, but our critical infrastructure cannot be made reasonably secure unless we do."

Richard Clarke, for one, believes that it's going to regulation — a dirty word in Washington — to really make a dent in thing. At the S4 conference earlier this year, he suggested that the country needs to set regulatory deadlines industry by industry for rolling out security enhancements to new and legacy systems that affect critical infrastructure. He believes that the research for the right technical solutions will only follow this kind of hard-and-fast regulation, because significant investments need to be made.

"In the absence of regulation, none of this is going to happen," he said. "In the absence of regulation, no one company is going to say, 'I'm going to do this.' In the absence of regulation, no one sector is going to say, 'We are going to do this.'"

For his part, Neray agrees with the MIT report that tax incentives could also help do the trick.

"Tax incentives would be a great way to do it," he says. "Tax incentives are just generally more popular than more regulation. And incentives to spend more on continuous monitoring to protect our infrastructure — that sounds like a no-brainer to me."

Related Content: