Week 3 Case Study 2 Submission
Asa J Opie
Sec 310
Professor Nerove
Strayer
7-20-2014

Week 3 Case Study 2 Submission A critical infrastructure is defined as any facility, system, or function which provides the foundation for national security, governance, economic vitality, reputation, and way of life. (http://www.dhs.gov/xlibrary/assets/NIPP_InfoSharing.pdf)In short, critical infrastructure is by definition essential for the survival of the nation. The USA PATRIOT Act specifically defines critical infrastructure as "systems and assets, whether physical or virtual, (Jena Baker McNeill and Richard Weitz, 2010) so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters." FEMA defines critical infrastructure as "personnel, physical assets, and communication (cyber) systems that must be intact and operational 24x7x365 in order to ensure survivability, continuity of operations, and mission success, or in other words, the essential people, equipment, and systems needed to deter or mitigate the catastrophic results of disasters." (http://www.dhs.gov/xlibrary/assets/NIPP_InfoSharing.pdf) The DHS Daily Open Source Infrastructure Reports specify the following sectors as part of critical infrastructure: Energy, Chemicals, Nuclear Reactors, Materials and Waste, Defense Industrial Base, Dams; Banking and Finance, Transportation, Postal and Shipping, Information Technology, Communications, Commercial Facilities; Agriculture and Food, Water, Public Health and Healthcare; Government Facilities, Emergency Services, National Monuments and Icons. (http://www.dhs.gov/national-infrastructure-coordinating-center) Obviously, not only are there various definitions of critical infrastructure, but there are so many specified components of it that it is impossible to lock-down or lock-out everything. Furthermore, attempts to specifically define critical infrastructure may be futile, since there are several ways to look at the concept. First of all, one could base the concept in notions about the value of human life. This asset value approach is usually taken when the idea of "continuity" is considered. The way it's usually put is by saying that the continuity, or continued operation, of a critical infrastructure is essential for the maintenance of human life and/or the maintenance of some standard of living that people have become accustomed to. The continuity of critical infrastructure is essential to avoid panic and hysteria during the impact of a disaster. Every day, a person's life is shaped or affected in some way by one or more critical infrastructures. Life, as we know it, is not possible without critical infrastructures, and they are all connected together in a "system of systems" where failure in one can cascade into a failure of all. This line of thinking is not only important to authorities who want to make sure that life stays worth living, but it is also the hope and dream of terrorists to find that one small chunk in the armor which makes the whole house come down. (Jena Baker McNeill and Richard Weitz, 2010) In other words, terrorism represents the ultimate "anti-continuity." Yet, others approach the concept of infrastructure as representing those things indispensable for cultural purposes. This is the thinking behind identification of vital or key assets, which are usually things synonymous with national pride, prestige, morale, confidence, reputation, and accomplishment of mission. An example of a key asset would be a national monument or icon which needs to "survive" because neglecting it would send the wrong message. Reasonableness and timeliness are the basic elements of survivability in this mode of thinking, with reasonableness meaning the degree of environmental stress, and timeliness meaning the notion of "mission-critical" during certain periods of time. An example would be an electrical blackout on New Year's Eve in the Big Apple where Americans wouldn't be able to mark the start of the New Year in the way they have become accustomed
Cybersecurity experts say this is just one example in a larger trend of attackers targeting industrial control systems of critical infrastructure. A public utility was recently compromised when a hacker gained access to its control system network, according to a May report from the Department of Homeland Security. The exact identity of the hacker group in the Symantec report is not known but they appear to work hours that coincide with the workday in Eastern Europe, according to the report. Spain, U.S., France, Italy and Germany have the most “active” infections where additional malicious activity has been detected. (http://www.dhs.gov/xlibrary/assets/NIPP_InfoSharing.pdf)
A few years ago this group, which Symantec calls Dragonfly (others call the group Energetic Bear), mainly targeted U.S. and Canadian defense contractors. “In 2013 and 2014 we saw it shift to the industrial base and now we’re seeing a lot more targeting of the energy [sector],” Vikram Thakur, a Symantec security response researcher told CIO Journal. (http://www.dhs.gov/national-infrastructure-coordinating-center)
Symantec’s research provides more evidence, on the heels of a report by security firm F-Secure, that the websites of three industrial control systems software suppliers were infected with the Havex Trojan. That software infects the software installers on those websites. When customers download industrial control software, they also download malicious software that targets an older version of the Open Platform Communications server, a common server for such systems, to gather information about connected control system resources within the network.
However, elsewhere at the conference, experts talked about more basic problems with securing energy grids, water plants, or other critical infrastructure. Many questions remain about what kinds of attacks might be possible, what their effects might be, and how to best defend against them. (http://www.dhs.gov/xlibrary/assets/NIPP_InfoSharing.pdf)

A major part of the problem is that the manufacturers of infrastructure equipment such as power grid switches have long placed reliability over security and are still in the process of shifting their priorities.
Companies such as Siemens and ABB, which between them dominate the global market for power grid and industrial equipment, are working hard on making their new designs secure. But the results will be very slow to appear because infrastructure companies replace equipment so infrequently. “What they are working on will be the new devices in the next year,” said Marcelo Branquinho, executive director of TI Safe, a company based in Brazil that specializes in securing industrial control systems and is part of an effort to create an international standard for such defenses. “The [power] industry has 20-year-old devices—we have to think of other kinds of tools.” (http://www.cpni.gov.uk/advice/cyber/)

References http://www.cpni.gov.uk/advice/cyber/. (n.d.). Retrieved from http://www.cpni.gov.uk/advice/cyber/: http://www.cpni.gov.uk/advice/cyber/ http://www.dhs.gov/national-infrastructure-coordinating-center. (n.d.). Retrieved from http://www.dhs.gov/national-infrastructure-coordinating-center: http://www.dhs.gov/national-infrastructure-coordinating-center http://www.dhs.gov/xlibrary/assets/NIPP_InfoSharing.pdf. (n.d.). Retrieved from http://www.dhs.gov/xlibrary/assets/NIPP_InfoSharing.pdf: http://www.dhs.gov/xlibrary/assets/NIPP_InfoSharing.pdf
Jena Baker McNeill and Richard Weitz, P. (2010, april 27). http://www.heritage.org/research/reports/2010/04/how-to-fix-homeland-security-critical-infrastructure-protection-plans-a-guide-for-congress. Retrieved from http://www.heritage.org/research/reports/2010/04/how-to-fix-homeland-security-critical-infrastructure-protection-plans-a-guide-for-congress: http://www.heritage.org/research/reports/2010/04/how-to-fix-homeland-security-critical-infrastructure-protection-plans-a-guide-for-congress