Notes

Lessons Learned and Thoughts on Next Steps in Cyber Defense for Critical Infrastructures

Critical infrastructure is a target for several types of bad actors: state-sponsored hackers, hacktivists, and cyber terrorists. These attacks might aim to demonstrate power, exact revenge, spread fear, or seek financial gain. Consider the rise of cryptojacking, which uses mining malware to hijack computers to mine cryptocurrency. In a constant quest for more devices, processing power, and electricity, attackers have ventured into the new environment of industrial control systems (ICS). The panel was a one on one discussion between two of the most influencial company heads: Yosi Schnek and Yaser Al Shehhi moderated by Zori Kor, where questions aimed at how critical Infrastructures' Security is handled in both IEC and Nawah Energy Company. In another example, perhaps one of the best-known cyberattacks on a utility is seen in Ukraine. A Kiev power grid was hit with malware, which caused a blackout affecting around 250,000 households. As for the actual lessons learned from said cyber attacks, the panel concluded as followed:
1. No system is safe.
A permanent staple in the cyber world, no system is safe.
2. Test often.
Keeping the critical infrastructure efficient and effective is challenging enough. Yet finding the time to consistently audit and always be improving security is critical too.
3. Train your personel
This should include making your people aware of the importance of all aspects of security, and protocol in dealing with sensitive systems
4. Stay current.
Industrial control systems too often run out-of-date software on legacy platforms.
5. Seek expert help.
permanent security audit and penetration testing is crucial to claim some sort of technological relevancy