In the IEEE Spectrum “Techwise Conversations” podcast with the title “The Critical Thread to Critical Infrastructure”, Steven Cherry invited Steve Chabinshky, FBI Cyber Division’s deputy assistant director, to talk about the cyber threads our nation is facing from attackers with different objectives. Some of these attackers want to control our machines for unlawful activities, want to steal our private information such as credit cards, etc. But something we don’t think too often is the fact that critical infrastructures such as nuclear and power plants, chemical processing plants, electrical grids, transportation, and others are controlled by systems which could become a target for cyber terrorist attackers seeking to damage the nations infrastructure. In fact, these type of attacks have been found by the FBI to be the conversation of terrorist organizations with plans to induce damage to the United States. The damage resulting from a security breach to any of these infrastructures could result in deaths of thousands of people.
With the increasing pervasiveness of technology, we have become more vulnerable to cyber attacks. For example, our cars are filled with embedded systems that control specific critical tasks such as acceleration, brakes system, and engine. If an attack were made on the manufacturer’s production line so to trigger erratic behavior on the car once the user reaches certain acceleration, there would be a lot of accidents with probable deaths and would lead the company to possible bankruptcy.
In order to fight back cyber attacks, efficient security models need to be put in place. Steve Chabinsky breaks the risk model into three: vulnerabilities, threats, and consequences. He mentions that the cybersecurity efforts nowdays to reduce vulnerabilities to zero has been a never-ending game since a specific system cannot be impenetrable unless it is completely isolated in every way from the internet; which is not the desire of todays systems. Therefore, more focus needs to be aimed to threat reduction and deterring of threat actors in order to diminish peoples risks. More importantly, these security models need to be prioritized to critical infrastructures since there are no existing architectures to protect them.
A final point touched by the article was that there is a lack of options to prosecute attackers due to the insufficient evidence of the attack. Therefore, according to Steven Chabinsky, new technology research needs to focus on two factors: assurance and attribution. Providing the architecture to assure that the software and data can be trusted and providing a way to trace back the attacker in order to hold it accountable.