Page 52 - Security Today, July/August 2021

The Nation’s Infrastructure Exploring the complexity of “unmanned” critical infrastructure protection
BTy Guerry Bruner
he last 12-18 months have shown us just how impor- tant our nation’s infrastruc- ture is to our daily lives as well as our health and
safety. However, the complexity of these systems and the risks they face may some- times make us feel that properly securing them is an insurmountable feat.
According to the Cybersecurity & Infra- structure Security Agency (CISA), “Criti- cal infrastructure describes the physical and cyber systems and assets that are so vital to the United States that their incapac- ity or destruction would have a debilitating impact on our physical or economic secu- rity or public health or safety. The Nation’s critical infrastructure provides the essential services that underpin American society.”
WHAT DOES THIS INCLUDE?
The following 16 sectors have been iden- tified by the Department of Homeland Security (DHS) as critical infrastructure because any disruption to their operation would have such a significant impact:
• Chemical
• Communications
• Commercial facilities
• Critical manufacturing
• Dams
• Defense industrial base
• Emergency services
• Energy
• Financial services
• Food and agriculture
• Government facilities
• Healthcare and public health
• Information technology
• Nuclear reactors, materials, and waste • Transportation systems
• Water and wastewater systems
This is an incredibly complex system in which many sectors not only rely heavily on each other but also have several sub- sectors, each with their own unique re- quirements and considerations. Within the transportation systems sector alone, there are seven key subsectors: aviation, high- way and motor carrier, maritime transpor- tation system, mass transit and passenger rail, pipeline systems, freight rail, and
postal and shipping.
Looking deeper into each of the sub-
sectors reveals even more complexity. For example, the highway and motor carrier subsector includes over 4 million miles of roadway, more than 600,000 bridges, and more than 350 tunnels, as well as vehicles, vehicle and driver licensing systems, traffic management systems, and cyber systems used for operational management.
IDENTIFYING OPPORTUNITIES FOR IMPROVEMENT
While the sheer enormity of these sys- tems may seem daunting, there are many opportunities within each sector to help improve the security and resilience of our infrastructure. One such opportunity is Intelligent Traffic Systems (ITS). Spread across the United States’ roadways and on the corner of virtually every intersection are hundreds of thousands of unsecured targets for attack—traffic cabinets and ITS devices. Used to store and protect technolo- gy that connects and controls traffic signals, vehicles, and digital road signage, traffic cabinets are critical for road and highway safety. Exposed at the network “edge” and housed inside these cabinets are intelligent devices and connectivity that if left unpro- tected, leaves our country’s infrastructure and citizens exposed to critical safety risks.
Unauthorized entry into an ITS cabi- net not only enables a potential attack or vandalization of connected intersections but could also allow access to the entire
network of traffic controllers and camera feeds. In addition, most cabinets have ac- tive network connections to state and mu- nicipal agencies, putting them at serious risk of cyber-attack.
Securing access to our infrastructure and managing authorized users is critical, as we are now exposed to an entire gamut of risk from seemingly harmless vandalism to more malicious physical and cyber-attacks. Managing the security and access of our ITS networks and infrastructure is an abso- lute must. In doing so, we not only apply physical controls to connected intersections but also protect the entire network of traf- fic controllers, connected vehicles, cameras, digital signage, and IoT devices.
ITS networks are not isolated—they in- terconnect cities, states, and their citizens. Failure to secure them puts both agencies and the public at serious risk of attack.
Despite the fact that physical access to traffic infrastructure can have an immedi- ate and widespread impact, the majority of cabinets are secured with a generic physical key that can easily be obtained and dupli- cated. Hundreds of thousands of key-hold- ers currently have access to a piece of our country’s critical infrastructure.
This presents a serious threat as we continue to rely more on sophisticated technology to operate and control our vehicles and signal systems. Do you know who has access to your ITS devices and traffic cabinets? Do you know if your cabi- nets are secure right now? Unauthorized
52
JULY/AUGUST 2021 | SECURITY TODAY
CRITICAL INFRASTRUCTURE
Konstantin Zaykov/Shutterstock.com