Critical Infrastructure Protection
Pamela S. York
CIS502, Dr. Glenn Hines
2/14/15
Abstract
The explosion of the accessibility of information and data via the today’s Web has brought along the concern and need for cyber security. With these issues of cyber security has also come the need to protect national informational assets from hackers and such who utilize the Web as a means to attack information that can aid in cyber terrorism. Information professionals are now looking to measures of protection that will ensure private citizens are not put into danger by the threat of cyber espionage. This also has extended to the protection of critical infrastructure within the United States and abroad.
Critical Infrastructure Protection
With the ever evolving presence of cyber-attacks that threaten to put citizens’ privacy and Internet security at risk, the government has had to intervene in order to take measures to protect its’ citizens due to the alarming fact that cyber-attacks are replacing other modes of attacks by terrorists. The Department of Homeland Security, created in 2002, was developed to carry out broad missions such as preventing terrorist attacks within the United States. This was mainly in response to the terrorist attacks that occurred on U.S. soil on September 11, 2001. Since then the DHS has taken on the mission of developing security that extends to information security and developing plans to implement critical infrastructure. The Homeland Security Act of 2002 extends the mission of this department even further. According to Caldwell (2014), “the DHS is to, among other things, carry out comprehensive vulnerability assessments of CI; integrate relevant information, analyses, and assessments from within DHS and from CI partners; and use the information collected to identify priorities for protective and support measures works in collaboration with the private sector to enhance their own cyber security in an effort to make the private sector less vulnerable to the threat of attacks” (p. 2). This mission of the DHS also extends to protecting critical infrastructure that may be compromised as a result of natural as well as man-made disasters.
Critical Infrastructure Protection
The National Infrastructure Protection Plan of 2006 issued by the Department of Homeland Security attempted to combine the national efforts to protect the nation’s critical infrastructure into a centralized plan. The NIPP has been updated in 2009 and again in 2013 and focuses mainly on outlining the Department of Homeland’s security roles as it relates critical information protection and also provides a framework of how the department should carry out key risk management strategies (Caldwell, 2014). In 2008, the DHS identified 16 critical infrastructure sectors. These sectors include: chemical, communications, dams, emergency services, financial services, government facilities, information technology, transportation systems, commercial facilities, critical manufacturing, defense industrial base, energy, food and agriculture, healthcare and public health, nuclear reactors, materials and waste, and water and wastewater systems (Radvanosky & McDougall, 2013). Under the CIP plan, vulnerability assessments are performed at key critical infrastructure facilities within these sectors to identify areas that may be at risk of high vulnerability to attacks and/or disasters. A vulnerability assessment, as defined by the Department of Homeland Security, is “process for identifying physical features or operational attributes that render an entity, asset, system, network, or geographic area open to exploitation or susceptible to a given hazard that has the potential to harm life, information, operations, the environment, or property” (Caldwell, 2014, p.4). The type of tools used to carry out these assessments can vary by agencies within the Department of Homeland security. Some examples of the assessment tools used include Joint Vulnerability Assessment (JVA) and Baseline Assessment for Security Enhancements (BASE), which are utilized by the Transportation Security Administration; and Port Security Assessment which is used mainly by the Coast Guard (Caldwell, 2014).
Since the NIPP’s inception, there have been issues identified with how critical infrastructure protection has been carried out by these various Department of Homeland agencies and departments. There have been no advancements in ensuring consistency of how the vulnerability assessments are carried out causing some to feel that critical areas within information security are being left unprotected by the agency and its departments. Some of the areas assessed include vulnerabilities to intentional acts such as terrorism but do not include tests on how to protect critical infrastructure in the event of a natural disaster. Hurricane Katrina of 2005 and Hurricane Sandy of 2012 brought many of these issues to the forefront as these natural disasters were huge events that continued to shed light on information security vulnerabilities that can be exposed as a result of natural disasters. Furthermore, these disasters further brought to light the Department of Homeland Security’s need to address these vulnerabilities in their testing and to broaden their focus beyond intentional acts of terrorism (Caldwell, 2014). Determining how to close these gaps will be at the forefront of strategy development for information systems professionals who work to secure these critical systems.
Information Systems Professionals and Their Roles in CIP
The information systems professionals who work in these agencies and beyond to protect critical infrastructure have a daunting task as new vulnerabilities and cyber threats are constantly exposed and brought to the surface. Some of the cyber security threats and vulnerabilities that are an ever present danger to the U.S are the presence of malware attacks such viruses and worms that can be used to gain control of top secret national security information. With so much data so readily available on the Web, cyber espionage is the go to method many terrorists and other groups are using to expose vulnerabilities in order to launch attacks. These types of attacks as well as other denial of service attacks should be a major focus of many information security professionals who have to protect the U.S. critical infrastructure sectors. The most prevalent methods of protection being used and that will more than likely be most successful in these efforts are the installation of malware defenses such as anti-virus software, security training and awareness at the governmental as well as private sector, and controlled access based on a need to know basis at the governmental level (Harrop & Matteson, 2013).
The use of a malware defense strategy by information security professionals can be critical in the identification of threats that aid in cyber espionage. One such attack known as the Flame virus in 2012 had the ability to gain control and pass information from webcams and also remotely send screenshots from computers that had been infected with the virus. The Middle Eastern regions of Israel, Syria, and Iran were most susceptible to these Flame viruses which had been around for 2 years before its detection (Harrop & Matteson, 2013). Security training and awareness is also an effective method in that it would bring to surface and provide education to those within governmental agencies and the private sector who are not as familiar with these threats as information security professionals are. Education is the key to informing users of information systems threats so that any suspect activity can be detected quicker and escalated appropriately. Controlled based access to information systems is also important in that given users access to only the information they require will decrease the likelihood that security related information does not fall into the wrong hands. Developing these types of strategies as well as broadening the public’s mindset on how the Web can be used to the detriment of our society will hopefully increase the security of information systems for everyone involved.

References
Harrop, W., & Matteson, A. (2013). Cyber resilience: A review of critical national infrastructure and cyber security protection measures applied in the UK and USA. Journal of business continuity and emergency planning, 7, 149-162. Retrieved from EBSCOhost database
Caldwell, S. L. (2014). Critical Infrastructure Protection. GAO Reports, 1-76. Retrieved from EBSCOhost database
Radvonosky, R., & McDougall, A. (2013). Critical infrastructure: Homeland security and emergency preparedness (3rd ed.). Retrieved from ESBSCOhost database