Critical Infrastructure Security: Policy, Threats, and Federal vs. State Roles

Evolution of Critical Infrastructure

• 💡 The definition of critical infrastructure has evolved significantly over the past 15-20 years due to increasing reliance on telecommunications, semiconductors, and rarer minerals.
• 🎯 Protecting critical infrastructure is more challenging than defending enterprise networks due to a large amount of legacy systems and the difficulty in regulating privately owned infrastructure across different sectors.

Pressing Cyber Threats

• ⚡ Threats like the SolarWinds attack and faulty patches (e.g., Cloudstrike impacting airlines) highlight the severe consequences of supply chain vulnerabilities and unvalidated updates.
• ⚠️ Ransomware remains a significant concern, alongside persistent phishing attacks and the growing vulnerability related to the consistent access and supply of advanced semiconductors.
• 🏥 The WannaCry attack demonstrated how cyber threats can disrupt critical sectors like healthcare, causing significant harm and financial gain for malicious actors.

Regulatory Landscape and Federal Role

• 🏛️ Historically, critical infrastructure was primarily a state and local responsibility, but the federal government has taken a more active role since 2013 with initiatives like Presidential Policy Directive 21 (PPD21) and the NIST Cybersecurity Framework.
• 🤝 The creation of CISA (Cybersecurity and Infrastructure Security Agency) under the first Trump administration aimed to centralize efforts in protecting critical infrastructure from cyber threats.
• 🌐 Federal authorities have established mechanisms like the Multi-State Information Sharing and Analysis Center (ISAC) and the Joint Cyber Defense Collaborative to improve threat sharing and coordination.

Election Systems as Critical Infrastructure

• 🗳️ There is a strong argument that election systems should be considered critical infrastructure due to their importance in national stability and the need to ensure reliable and secure voting processes.
• 🇺🇸 In 2017, the Department of Homeland Security designated key components of election infrastructure as critical, with CISA monitoring and assessing threats, though this has become a politicized issue.

Politicization and Decentralization Challenges

• 📉 The politicization of critical infrastructure, particularly concerning election security and agencies like CISA, has led to distrust and a push for decentralization back to state and local governments.
• 💰 Devolving roles to state and local governments can be problematic due to funding constraints, as these entities often rely on federal support and have balanced budget requirements, unlike the federal government's greater flexibility for deficit spending.
• 🧩 While information sharing through CISA has been successful, concerns exist about the impact of decentralization on coordinated response and the potential for increased recovery times after breaches.

Current Readiness and Future Concerns

• 📈 Despite significant strides in improving defense systems and information sharing over the past 15 years, the US still faces challenges with legacy systems and potential unforeseen risks.
• ⏳ The primary concern is not necessarily increased vulnerability of legacy systems, but rather the speed and effectiveness of recovery from future breaches, especially with potential cuts to agencies like FEMA.
• 🐍 An anecdote highlights how imperfect systems are sometimes tolerated for their ability to keep essential services running, emphasizing the trade-offs in managing critical infrastructure.