What would 'best practice' look like in protecting critical infrastructure against state actor cyber attack?

Question

I was reading this article from the New York Times, which details the alarming degree to which the IT systems running critical civic infrastructure have allegedly been compromised by Russian cyber attackers.

In particular, my question relates to the text:

Still, new computer screenshots released by the Department of Homeland Security on Thursday made clear that Russian state hackers had the foothold they would have needed to manipulate or shut down power plants.

“We now have evidence they’re sitting on the machines, connected to industrial control infrastructure, that allow them to effectively turn the power off or effect sabotage,” said Eric Chien, a security technology director at Symantec, a digital security firm.

“From what we can see, they were there. They have the ability to shut the power off. All that’s missing is some political motivation,” Mr. Chien said.

Clearly, security should be important to infrastructure providers but protecting against state sponsored level attacks may be beyond their capacity.

What measures have been taken to minimize the threat of state actors compromising critical infrastructure - particularly drawing on examples from other countries - that could be combined to define 'best practice'?

From an abstract perspective, I'm suspecting the best answer would likely involve a suite of infrastructural, technical, assurance and legislative/regulatory measures.

e.g. establishment of a body of oversight with powers to penalize non-compliance, having a separate physical network, vetting of involved personnel, vetting of involved infrastructure hardware providers, an ongoing vulnerability bounty program, innovative cryptographic methods, etc.

Answer 1

Warning, lots of text. Very complicated issue. tl;dr is: we as a nation are not doing much and have not been doing much. The current mentality is "it's up to businesses to fix it before the GOVT has to get involved." Companies don't want to pay, and don't know what to do, and don't see a "market motivator" (yeah, literally hear that all the time. I'm not kidding). Europe is doing much better with the push towards 62443 requirements for all ICS.

I'm primary on ICS/Critical Infrastructure for a company that is involved in the certification of security for devices associated with this. And I have bad news. there is not much requiring most infrastructure to secure itself. Nerc-CIP is related to power grid, but not everything has security requirements. Nuclear has some, through both NEC and IAEA and their overlap with Power Grid. Otherwise... not much.

Every year there are speeches at security conferences about how "squirrels" have done more damage to our infrastructure than hackers. That said, remember there is no honest disclosure rules for infrastructure. We don't really know how much is squirrels and how much is not.

I can tell you this though, as a first hand ICS pen tester who has worked with a slew of products in this space... at least 1/3 of -new- products come in the door critically vulnerable (in my experience. and I'm being generous), and only a very small percent in total have clearly been built with a full "defense in depth" security plan. Good news is when we are done with them they are way more secure and the companies we have worked with are developing better practices (if needed).

Also good news, there are good practices to secure insecure devices inside a network, even if the devices are not secure, but there are not a lot of constant audits and checks for this. In fact, my experience is the HIPPA, PCI, and SOX all have much firmer rules and accountability than securing Crit. Infrastructure. I'm also including 911 response systems in this, which have been shown to be vulnerable also.

There are a myriad of examples from the past 10 years, which really ramped up in the past 4, of nation state style attacks on Crit. Infrastrucutre. The Ukrainian power grid has been attacked multiple times using multiple tools, the thinking being it's a training ground for Russian hackers. The US gov't attacked nuclear facilities in Nitanez using custom malware in a very famous exploit back in 2010-ish. Lots more. Too much for this response.

As far as what's being done... not much. Companies can't afford millions of dollars of renovation, there are no universally agreed upon standards for modern secure ICS protocols (yes, most ICS network protocols are plain text with no verification of devices), ICS teams can't find security professionals who understand ICS because there are -very- few. There is a slew of other issues...

And it gets worse... I literally sat at lunch with the former head of DHS. It was me, him, 2 other people. He was deeply concerned as our current administration is leaving massive staffing holes and seems to be completely uninvested in any sort of push to fix this issue and secure the nation. Yes, it's true they have lots of DC conferences to talk about it... but no one is putting up the money or creating legislation.

The good news is that in general we know how to secure our systems and what are the major weakenesses at every level of the technology stack (from CWE's to Network zoning). ICS-CERT (a branch of US-CERT, the american emergency response team for cyber) has a great articles on it. Along with NIST, IEC 62443, and a smattering of others. Good place to start for anyone in ICS who is now concerned. Google search this are there are multiple, find the one best suits your needs:

[google] filetype:pdf ics-cert best practices

Answer 2

NERC-CIP, is the standard process for protecting ICS systems. It defines a plethora or regulations and technical requirements for putting components online.

NIST helps define federal information system standards which includes OS and protocol security best practices. Our power infrastructure is maintained by private companies with federal regulations steering their compliance obligations.

A motivated attacker is going to approach your layered defense strategy as a team, each individual handles their piece and effectively finds a way in over time.

While one can not speculate on the article or the methods employed on the network in question; most often an adversary will target the operator vs. attack the systems directly.

Unilateral movement across a heavily defended network/infrastructure is difficult to keep a persistent foothold on without administrative credentials.