GUIDE

Critical infrastructure is a nation’s essential systems and assets on which the functioning of its residents depends.

As more of them integrate embedded systems that rely on digital communication, they become highly vulnerable to cyber threats.

This is why they have become a viable target for espionage campaigns and profit-driven cyber attacks carried out by state-sponsored attackers and profit-driven cybercrime groups.

Through our blog, we will look at some of the challenges that critical infrastructure organizations can face while securing their embedded systems, along with some of the best practices that they can use to improve their security.

What is critical infrastructure?

Critical infrastructure comprises all the essential systems and assets that are vital for society to function. These include the healthcare, power grid, water supply, transport networks, and industrial control systems.

For example, the following are the 16 critical infrastructure sectors as categorized by CISA:

• Chemical sector
• Commercial facilities sector
• Communications sector
• Critical manufacturing sector
• Dams sector
• Defense industrial base sector
• Emergency services sector
• Energy Sector
• Financial Services Sector
• Food and agriculture sector
• Government services and facilities sector
• Healthcare and public health sector
• Information technology sector
• Nuclear reactors, materials, and waste sector
• Transportation systems sector
• Water and wastewater systems

Source - EuRepoC Critical Infrastructure Tracker

What are embedded systems in critical infrastructure organizations?

Critical infrastructure entities depend on embedded systems for operations. These systems are specialized computing devices tailored to execute large-scale tasks on larger systems. They are critical for functioning and are used to make operations more efficient, automated, and controlled.

For example, they are used to control traffic and ensure safety in transportation systems, and are used to control energy flow in the power grid.

Embedded systems have become more interconnected with a high reliance on digital communication. Due to this, they have become a primary target of cyber threats. Let us look at the top risks and cyber threats specific to the critical infrastructure.

Top risks and threats for the critical infrastructure

• Loss of data, especially confidential data like state secrets, personal information of key government officials, and strategic/military plans.
• Operational disruption can cause stoppage of essential facilities like transportation, access to water, and power supply.
• The higher risk of civil unrest due to long-term lack of access to essential services, like water and electricity.
• Attacks on critical infrastructure like healthcare, water treatment, and power supply can threaten public safety directly.
• Regulatory fines from non-compliance with applicable cybersecurity/data security regulations due to data breaches.
• Reputational loss due to exposure of personal data and disruption of services.

Top primary sources of threats

• Cyber warfare by state-sponsored actors for espionage, collapsing critical systems, and destroying advisory systems.
• Non-state groups or cyber terrorism, or cybercrime groups that attack critical organizations for profit.
• Insider threats – employees with access to devices can pose more risk than the two above combined.

Source – EuRepoC Critical Infrastructure Tracker

Top cyber threats

Espionage

State-sponsored threat actors target critical infrastructure for stealing confidential information (like state secrets, strategic military information, and government plans). Some notable state-sponsored groups that carry out espionage campaigns include Lazarus Group (North Korea) and RedNovember (China).

Ransomware and APT (Advanced Persistent Threats)

It is a type of cyber attack that is often carried out by state sponsored groups in which they infiltrate networks using advanced techniques and use methods to maintain camouflage within the networks to continue stealing secrets and further their espionage campaign.

Critical infrastructure-targeted ransomware attacks have also risen over the past few years as profit-driven cybercrime groups target large critical infrastructure organizations. They are causing operational disruption by making their operational data unavailable, and encrypting & publishing personal information of employees, company secrets, and other confidential information.

AI-driven cyber threats

Cybercriminals are using AI to make their phishing campaigns more sophisticated, improving the persistence of their attack campaigns, making their attacks more undetectable & damaging, automating the identification and exploitation of vulnerabilities, and generating sophisticated malware. They are using AI to deceive AI-driven threat detection systems through prompt injection and data poisoning.

Insider attacks

State-sponsored adversaries may target vulnerable people in critical organizations using advanced data analytics and other malicious tools to gather confidential information and other information (like an IT infrastructure map) to improve the effectiveness of their attacks.

Attackers use the compromised/vulnerable insiders’ access/privileges to install malware like infostealer or move laterally across the network, or orchestrate their attack further, including physical tampering. Insider threats can also be due to complacency or negligence of employees in critical infrastructure organizations who may inadvertently upload sensitive documents.

Other threats

• Distributed Denial of Service Attacks – attackers disrupt operations by flooding and paralysing the network with data from many computers.
• Sabotage – cybercriminals use malware that can disrupt physical processes like electricity supply or the functioning of a nuclear power plant.
• OT/IoT attacks – attacks orchestrated through the exploitation of vulnerabilities in Operation Technology systems and IoT used by critical infrastructure.
• Supply chain attacks – attackers target associated third-party vendors to exfiltrate data from critical infrastructure entities.

Top challenges to secure embedded systems

Unlike traditional IT systems, embedded systems come with limited processing power, constrained memory, and most cybersecurity measures are insufficiently tailored to them.

Due to this, Industrial Control Systems, PLCs (programmable logic controllers), Distributed Control Systems (DCS), and SCADA (Supervisory Control and Data Acquisition platforms) that manage assembly lines and other critical processes on a factory floor, become prime targets.

The following are the top challenges to securing embedded systems:

• They have limited processing power and memory, which makes the use of resource-intensive security protocols a challenge.
• They are deployed in distributed environments, leading to the creation of complex networks for which security protocols can be challenging to enforce.
• Many embedded systems come with software that is unpatched for longer periods, making them vulnerable to threats. Since they were not designed with security in mind, they remain operational for longer periods while being exposed to vulnerabilities
• These systems are also exposed to threats like physical tampering, man-in-the-middle attacks, and remote exploitation of network vulnerabilities
• They are prone to social engineering and insider threats, whether intentional or unintentional (negligence/complacency)
• Since they are essential for the functioning of society, they are subject to complex cybersecurity standards and laws that require organizations to adhere to the requirements.
• Organizations may have a small budget for cybersecurity or limited skills on board to effectively design a tailored cyber risk program.
• The integration of IoT can expose organizations to risks, as they come with weak default security.
• Critical infrastructure with legacy systems lacks network segmentation, causing the escalation of a breach.
• Third-party risks are often exploited by attackers to target critical infrastructure organizations in a full-fledged supply chain attack.

Cybersecurity best practices for critical infrastructure organizations

The following are some of the best practices that critical infrastructure entities can follow for a resilient security posture:

• Enable encrypted communication between embedded systems (for both data in transit and at rest) with encryption algorithms optimized for the limited resources of embedded systems without causing latency issues in their performance.
• Enable secure boot mechanisms to ensure that only trusted software is run, reducing the risk of malware or execution of unauthorized code.
• Implement measures to ensure physical security, like Trusted Platform Modules (TPM) that secure cryptographic keys and sensitive data assets.ss
• Intrusion Detection Systems optimized to work without consuming many resources can serve as an effective system to detect unusual behaviors indicating an ongoing attack or predict threats.
• Implement AI and ML-based threat detection that identifies and mitigates attacks in real time.
• Implement secure coding practices that can prevent security loopholes and use static analytics tools to detect flaws in code.
• Identify and implement an effective patch management system to ensure updated firmware and reduce the risk of exposure.
• Implement a zero-trust approach where devices and identities are verified on every attempt to log in. Segment systems across trust boundaries.
• Create a unified governance and monitoring mechanism for both IT and OT environments to bridge silos.
• Regularly test the cybersecurity posture for security and compliance gaps, taking the help of experts to carry out tabletop simulations, validating IR strategies, and carrying out red team exercises regularly.
• Create a detailed third-party risk management program that holds vendors and third-party vendors accountable for risk and requires them to regularly assess their cybersecurity posture for risks and implement measures like least privilege access.
• Take proactive measures for recovery – create redundancy, build failover capabilities, and clear incident response playbooks and mandate backups of all the sensitive data and operational data for quick resumption.