Utilities, Nations Need Better Plan Against Critical Infrastructure Attackers

In February 2019, the group behind the Triton attack on oil and gas companies changed their tactics: The group started scanning electric utility companies for vulnerabilities, according to critical infrastructure security firm Dragos.

The switch in targeting is the first publicly known instance of a group behind a specific critical infrastructure attack targeting multiple infrastructures, says Sergio Caltagirone, vice president of threat intelligence for Dragos. The capability to attack more than one target suggests the actors in the group have become more sophisticated and better-funded, he says.

"The challenge is that for as long as we have been tracking industrial threats, the threats have effectively stayed in their own silo," Caltagirone says. "They have either been geographically focused or sector-specific, and the reason is that it costs so much time and resources to attack one specific sector of industrial that there really hasn't been any publicly known group that has been able to cross over."

The problem is that, while attackers have increased their capabilities, defenders still remain stuck with a limited number of tools—both technological and political—to dissuade the attacks on their networks. Most governments and companies targeted by such attacks are left with a single option: Learn about the attackers and then kick them out of the infrastructure. 

"We need a strategic response," Caltagirone says. "There has to be some sort of recognition that we are all in the same space, and we have to somehow find a way to put pressure on them to stop."

Critical infrastructure owners have a harder cybersecurity problem than most companies. Creating a reliable infrastructure has always been a priority, and that means not creating chaos with major changes or software updates. For that reason, industrial devices and critical infrastructure are designed to be deployed for decades rather than years, making the standard software security approach of frequent updates more a logistical nightmare, said Tim Mackey, principal security strategist at Synopsys.

"With digital sensors and computing devices within industrial plants having lifespans far exceeding those of commercial devices, a comprehensive patch management strategy designed with a detailed understanding of the software supply chain powering these devices is a critical component of ongoing threat mitigation," he said in a statement.

For the most part, critical infrastructure companies keep watch on adversaries by passing around indicators of compromise (IOCs) among themselves through information sharing and analysis centers (ISACs). With adversaries changing their tactics frequently, however, they need to do more. 

"We have to get beyond IOCs—we have to, have to, have to," Dragos's Caltagirone says. "We have to start monitoring and identifying behavior. Because over time, over a year plus, these adversaries' (tools) are going to change so many times, it will be nearly impossible to protect yourself."

On the national level, despite the constant attacks on critical infrastructure, strategic options to dissuade such attacks seem in short supply. In 2018, the U.S. Department of Justice, for example, continued to use legal tools against such attackers, indicting both Russian and Chinese actors for attacking election infrastructure and private industry, respectively. The U.S. has imposed sanctions against both countries as well.

Nations and their critical industries need to go beyond those measures and cooperate on both limiting critical infrastructure attacks and improving defenses against such measures. 

"There has to be a defender that is not just the utility—meaning governments, transnational organizations, industry sharing groups, and so forth," Caltagirone says. "You can't have, say, Idaho protect against the Russians and have Mississippi have to do the same—that is an untenable request to make, and we don't make that request in any other domain."

For now, the intent of attackers—most of which are likely rival countries—is to find their way into targets of interest, according to Caltagirone. This activity, called "access operations," teaches attackers a great deal about the targets of interest and what countermeasures the defenders are deploying. 

"What they are doing right now is very intelligent. This is what a mature organizations does—they take the time to figure out what organizations they want to beat," he says.

Yet, in the end, if we don't figure out a way to deal with the attackers—whether through technology or policy or both—then the outcome is grim, Caltagirone says. "If we don't accept that understanding of the world and defend in that way, the adversary is going to walk right through all our defenses," he says.

Related Content