While attacks on critical infrastructure are not new, it is only recently that concerns have been seen in public view when Colonial Pipeline, an Agricultural cooperative in Iowa and Minnesota, was hit by ransomware.
One of the reasons it had been so hard to focus people’s attention on threats to critical infrastructure earlier is the term itself is broad and encompasses many things.
The IT and OT Convergence
Instead of computers and servers, systems that underpin IT fall under operational technology (OT), which is more common in enterprise IT. This is another reason that critical infrastructure has not been at the forefront of security awareness.
OT networks were designed for safety, not to break down and cause damage or harm to human beings. OT systems have become an integral part of enterprise networks as organizations have focused on making OT more efficient, safer, and cost-effective.
Also Read: Three Ways to Boost Employee Satisfaction in Cybersecurity Team
IT and OT convergence have significant benefits, including more efficient remote monitoring and managing of operational technologies collecting information from sensors located in remote locations. But it also introduced cyber security threats that had never existed before in OT networks.
Increasing Threat to Critical Infrastructure
Many attacks on critical infrastructure have been carried out on industrial IoT, demanding hefty budgets and resources. Cybercriminals now earn billions from targeting essential infrastructure, gaining the ability to generate even deadlier attacks. With its convergence, operational technologies also face increasing cyber threats.
Changing Behavior of ransomware incidents
Ransomware attacks on OT do not have any particular pattern since many attacks have happened where the data on the machines were locked up and made unavailable have already occurred.
Cyber attacks are now very rarely smash-and-grab operations. After gaining initial access through a phishing link or a remote desktop, the attackers are willing to spend a lot of time on the target network once they place the malware. Investigating all the systems, they detonate the encryption on the bits that matter, and with new capabilities, they are quick enough to change the tactics.
Also Read: Security Disconnect: Why is the Role of CISO Evolving?
Artificial Intelligence to Protect Critical Infrastructure
As technology learns more about the patterns associated with the entire digital infrastructure, Artificial intelligence (AI) can play a significant role in this development. Before a human analyst, AI can notice deviations in device activity and trigger an alert that will impact all internal downloads from the compromised server without disrupting the business operations.
AI can provide the visibility needed to understand what every piece of equipment is supposed to do and is doing at all times. It can release preventive activities to assess the threats and help prevent the attack.
Here AI is not replacing but supporting humans by doing the heavy lifting in configuration and investigation. AI may not stop attackers from getting in, but it will surely minimize the damage by quickly spreading alerts.
For more such updates follow us on Google News ITsecuritywire News
