Defending critical infrastructure

Federal officials are beginning work with the private sector to prepare for the historic provision passed last week that requires critical infrastructure providers to notify the Cybersecurity and Infrastructure Security Agency of malicious cyber intrusions. 

Critical providers including utilities, banks, energy providers and other sectors will have to alert CISA within 72 hours of a major cyberattack or 24 hours of a ransom payment under new federal regulations. The requirements are part of a long-sought partnership that shields companies from liability and allows for rapid intelligence sharing.

The legislation gives CISA the authority to subpoena companies that fail to adhere to the reporting requirements and refer them to the Department of Justice if they fail to provide the requested information.

The goal of the legislation is to provide legal cover for companies to share threat intelligence with law enforcement and government agencies. The SolarWinds attack showed how federal authorities had little to no insight into the nation's IT infrastructure.

The private sector has only informed government agencies of about 30% of cyberattacks they have encountered, said Sen. Mark Warner, D-Va., chairman of the Senate Intelligence Committee, during a hearing last week on worldwide threats.  That means the government has no intelligence on about 70% of the cyber threats facing the U.S. 

Executives in the C-suite and shareholders often keep data breaches and cyberattacks on a need-to-know basis, fearing the embarrassment of public disclosure and concerned that information sharing would open them to investor suits, law enforcement probes and irreversible damage to brand reputation.

"Many companies have historically wanted to maintain plausible deniability because the disclosure of cyber intrusions has a material impact and is a source of significant reputational risk," Tom Kellermann, head of cybersecurity strategy at VMware, said via email. "For too long, the curtain of plausible deniability has been undermining cybersecurity investment."

The new legislation will help close visibility gaps for investigators and security responders, said Robert Sheldon, director of public policy and strategy at CrowdStrike, one of the nation's top cybersecurity and incident response firms. CISA and other relevant government agencies need timely access to threat information and ransomware, he said.

"Cyberattacks targeting critical infrastructure have grown increasingly severe and impactful over the past couple of years," Sheldon said. 

The law closes some visibility gaps for both investigators and responders, Sheldon said, which can help strengthen the overall security posture of critical infrastructure providers. 

However, providers still need to push to incorporate best practices for the purpose of proactive defense, including the use of endpoint detection and response, zero trust and sound log protection practices. 

Top vendors weigh in

In the months following the December 2020 discovery of the SolarWinds attack, Microsoft was a major proponent of greater information sharing between industry and the federal government. 

Microsoft, a target of the SolarWinds threat actor, which it dubbed Nobelium, publicly called out numerous other firms in the information technology space that were known to have been impacted by the same threat actor, either through the SolarWinds vector or direct impact, but failed to publicly share detailed threat information. 

"Amid increased threats from nation-state adversaries and cyber criminals, it's great to see Congress pass bipartisan incident reporting legislation — a strong step to shore up our nation's cyber defenses in critical infrastructure and strengthen the cyber ecosystem," Tom Burt, corporate vice president, customer security and trust at Microsoft said in a tweet after the Senate passed the incident reporting provision.

SolarWinds, which was originally notified of the attack by FireEye Mandiant researchers, said it readily shared threat information with federal authorities after the attack. 

Companies need to be open and transparent about disclosing sensitive data in order to prevent malicious attacks from spreading to other companies in the future, the company said.

"SolarWinds voluntarily notified the U.S. government when we learned of the Sunburst incident, which targeted SolarWinds and other companies, and we offered complete and total cooperation," Chip Daniels, head of government affairs at SolarWinds, said in an emailed statement. "The nature of today's cyberthreat landscape means the defense roles of the public sector and private companies are more interconnected now than ever - cybersecurity is everybody's responsibility."

SolarWinds fully supports the new regulations, Daniels said, and described the approach by CISA Director Jen Easterly and her team as spot-on. 

The practical import of this legislation will require a better understanding of the interim rules from CISA, however Daniels added that SolarWinds is looking forward to more details on how the process will play out. 

What it gives authorities

Beyond sharing cyberthreat information, the new regulations are designed to give federal authorities more insight and actionable intelligence on ransomware and extortion crimes in real time. 

While companies have been reluctant to share information on data breaches and simple supply chain attacks, they've been even more secretive about ransomware attacks. The hesitation is, in part, because they face the possibility threat actors posting sensitive company data or compromising information on the Dark Web or selling it to secondary threat actors.

Colonial Pipeline executives quietly shared information about $4.4 million in payments made to the threat actors, following an attack that caused a six-day shutdown of its massive fuel pipeline. The FBI was able to recover about $2.3 million through a court-ordered operation to claw back part of the bitcoin payments Colonial provided during the attack. 

"When Colonial's systems were threatened by a bad actor, notifying the authorities was a logical step," the company told Cybersecurity Dive. The FBI — and CISA via the FBI — were contacted by midday. 

The federal government can play an important role in providing guidance and sharing best practices for responding to an attack of this type, the company said, including sharing lessons learned from prior incidents. 

Colonial officials emphasized the importance for companies to have clear directions of who they should be working with in the government. A concern in the past has been company leaders did not know which agency was responsible for handling incidents. 

"For companies defending against these evolving threats or responding to an attack, having clear knowledge of who in government they should be coordinating with is important," the company said.

The Cybersecurity and Infrastructure Security Agency (CISA) is identifying what critical infrastructure would most impact U.S. national security and economy if hacked, according to CISA Director Jen Easterly during a virtual Center for Strategic and International Studies event. CISA is basing its analysis on economic and network centrality, and "logical dominance in the national critical functions," she said. 

CISA joins the Cyberspace Solarium Commission (CSC) in efforts to identify systematically important critical infrastructure (SICI), which CISA refers to as primary systemically important entities (PSIE). CSC recommended that Congress "codify the concept of" SICI, in its inaugural report last year.

"We're going to move forward and do it, whether it ends up in legislation or not," Easterly said. Though if PSIE- or SICI-related proposals end up in law, "it will be very helpful in continuing to bring the private sector to the table … We're in a state right now where critical infrastructure is much more vulnerable than it should be."

CISA is fast-tracking critical infrastructure categorization, and the companies most vulnerable to cyberattacks. The CSC wants Congress, after identifying these organizations, to ensure "the full support of the U.S. government and shoulder additional security requirements" to suit their "unique status and importance." 

In October, Rep. John Katko, R-N.Y., and Rep. Abigail Spanberger D-Va., proposed the Securing Systemically Important Critical Infrastructure Act, which would direct CISA to prioritize benefits for the owners and operators of specified critical infrastructure. Katko could see the bill included in the FY2022 National Defense Authorization Act (NDAA), he said during the webcast. 

Under Katko and Spanberger's bill, CISA would have to consult with the heads of Sector Risk Management Agencies (SRMAs) and create a methodology for determining what elements of critical infrastructure meet the threshold of maximum national security and economic impact. 

The bill also asks for identified critical infrastructure companies to have prioritized representation in CISA's Joint Cyber Defense Collaborative (JCDC). 

The proposal is in line with what the CSC asked for, where the government is "assured that these companies are taking their security responsibilities seriously, honoring the public trust that appertains to the services and functions they provide," the report said. 

What the government is working toward is something the private sector needs — different treatments based on the uniqueness of each critical infrastructure sector. In March, the White House announced it was reviewing OT/ICS operators, and prioritizing bigger utilities impacting larger populations. And in July, the Biden administration signed the National Security Memorandum, which tasked CISA with developing performance goals for critical infrastructure. 

Cyberattacks on critical infrastructure this year — particularly Colonial Pipeline and JBS USA — already led to firsts in cybersecurity requirements. In May, the Transportation Security Administration (TSA) announced two pipeline-specific cybersecurity directives. The TSA gave aggressive timelines for pipeline owners and operators to meet, though administrators said the TSA is willing to work with companies if they submit alternative procedures. 

Owners and operators using OT and industrial control systems (ICS) worry that the new requirements could impact the safety of their equipment if they move too rapidly. Meanwhile, the TSA admittedly is understaffed in cybersecurity. 

A similar announcement was made for railroad and airport operators in October. Secretary of Homeland Security Alejandro Mayorkas announced the TSA will also issue mandatory requirements for transportation sectors operating in the air, land or sea. Owners and operators will have to report incidents to CISA, though the complete published regulations are expected by the end of the year. 

Threat actors divulged sensitive data from operational technology (OT) environments in one in seven leaks targeting industrial organizations, according to Mandiant researchers.

Mandiant researchers identified more than 3,000 extortion leaks in 2021. About 1,300 of the leaks came from industrial organizations that were likely to use OT environments, including manufacturing plants, water companies and energy facilities.

Leaked data includes password administration credentials from a maker of industrial and passenger trains, a hydroelectric power producer's list of user privileges and passwords, and source code from a provider of satellite vehicle tracking systems.

The report highlights the risks critical infrastructure and production facilities face against sophisticated threat actors. Sensitive information that is essential to running these facilities safely is frequently exposed on the dark web and threatens the stability of key industrial sites. 

"Ransomware operators often advertise their victims and subsequent victims' data dumps as part of their multifaceted extortion scheme," Nathan Brubaker, director, Mandiant Threat Intelligence, said via email.

By posting sensitive information about these companies on shaming sites, a threat actor can leverage that information to attempt a forced payment. Victim companies become exposed to additional harm by other threat actors who can attempt to extort additional payments or leverage information for future attacks.

The report comes at a time when nation-state and criminal threat actors have ramped up attacks on major industrial sites in the U.S. 

Colonial Pipeline, the largest fuel supplier to the eastern U.S., was attacked in May 2021. Colonial paid more than $4.4 million to the attackers in order to resume operations after six days of fuel shortages and panic buying disrupted much of the southern and eastern U.S. 

Weeks later, federal authorities recovered about $2.3 million of the ransomed funds after investigators were able to partially trace the source of the cryptocurrency payments to the threat actors. 

Authorities issued warnings in late 2021 warning local grain were targeted in several ransomware attacks in Iowa, Minnesota and other states. Federal officials later warned of attacks against water and wastewater treatment facilities. 

Now, attention is turning toward critical infrastructure providers as authorities are urging organization to take measures against potential attacks in connection to the conflict over Ukraine.

Research from Nozomi Networks shows that while ransomware activity against critical sites rose during the second half of 2021, organizations are beginning to step up their efforts to prevent future attacks. 

Cybersecurity experts caution against something far more foundational than ransomware attacks or private data thefts when it comes to threats in the construction sector: Their eyes are on the security of building materials.  

"Take for instance the construction of a bridge, you have to have that strength integrity," said Jason Vigh, principal consultant for 1898 & Co., a Kansas City, Missouri-based business, technology and cybersecurity consulting firm. "What if [hackers] change the systems that are actually being used to automate [the project] and it collapses… all because the supply chain is compromised in the first place."

Construction companies use automation during the mixture and measurement of materials or chemicals going into a manufacturing process. For example, a concrete contractor uses control systems to mix the cement and lay the concrete. 

During the post-manufacturing process, construction pros use automation to test the structural integrity, such as surface hardness inspections, load testing and surface absorption checks.

The processes that go into the mixture and measurement of construction materials are vulnerable to cyberattacks because they use internet- and cloud-based technologies that have minimal defense parameters. If compromised, a cyberattack on these technologies could cause havoc that goes much further than companies’ wallets. 

These automated systems leave tempting holes for cyberattackers to compromise, cybersecurity experts say. That means material failure is a real possibility if the systems become an attacker's target.

Threat level rising

The attention on materials security comes as the Biden administration recently warned companies to harden their cyber defenses, as evolving intelligence shows Russia could launch a retaliatory attack against the U.S. and its allies. While the White House did not share specific targets, its steady stream of cybersecurity warnings are meant to harden critical infrastructure security.

Threat actors target the trillion dollar construction industry because it's a known as a laggard in cybersecurity. Ryan Johnson, director of cybersecurity at construction technology firm Trimble, told Construction Dive that these worst-case-scenario cyberattacks are a concern in the industry.

"The integrity of critical infrastructure is certainly in scope of a malicious actor attempting to cause harm," said Johnson. "Construction companies should look to embed security by design principles as part of their requirements definition stage for any structure components that are to be connected to the internet."

The mechanisms to safeguard and detect those changes in the construction industry lag other industries, Vigh said.

"Think about the financial sector and the transaction of large amounts of money on these financial networks. There's a lot of confidentiality and integrity checks that are in place for those types of systems," said Vigh. "But on the construction side, where you're talking about manufacturing and all those types of processes, those systems don't have the same protections."

A focus on security

At Dallas-based contractor Jacobs, cybersecurity is an increasingly important aspect of its business, especially specialized consulting, operations technology solutions and data analytics platforms. Earlier this year, the company reported accelerated requests for its data and cyber solutions from critical infrastructure customers, according to CEO Steve Demetriou during its first quarter earnings call. 

Jacobs' clients include the U.S. Department of Defense, the Combatant Commands, the U.S. Intelligence Community, NASA, the U.S. Department of Energy, U.K. Ministry of Defence, the U.K. Nuclear Decommissioning Authority and the Australian Department of Defence, as well as private sector companies in the aerospace, automotive, energy and telecom sectors.

To complement its focus on cybersecurity, Jacobs acquired all outstanding shares in November 2021 of BlackLynx, a provider of enterprise-scale software solutions for national security and commercial customers. In November 2020, it also acquired Buffalo Group, a leader in advanced cyber and intelligence solutions.

"There is not an infrastructure project right now with major agencies, in the U.S., the U.K., across the world, in Australia, where we don't have a cyber component that's with it,” said Bob Pragada, president and chief operating officer at Jacobs. "That's going to become a bigger part of our business as we continue to go forward… it's a great skill set as cyberthreats become as big of any threat that we have."

Publicly traded construction companies Tutor Perini, Granite and Fluor also all reported in SEC filings their awareness of the evolving nature of cyberattacks.

Construction cyberattacks grow

Most cyberattacks in the construction industry involve ransomware or target sensitive customer data, said Vigh.

"But the compromise begins from where the system interconnects," said Vigh. "Then it just depends on the adversaries' target."

Ghilotti Bros., a San Rafael, California-based concrete contractor, reported in December 2021 an unauthorized third party was able to temporarily access its systems and files. JMA Energy, an Oklahoma City-based oil and natural gas company, reported a data security breach in February. 

Neither JMA Energy or Ghilotti Bros. responded to requests for comment on those incidents.

Steve Arring, product director at Procore, said the company is seeing higher anxiety about cyberattacks from its customers. The Carpinteria, California-based firm grew its cybersecurity team over the last year by 300% and also made substantial investments in defensive measures, said Arring.

Contech giant Autodesk is also keeping an eye on the rising threat.

"It does require some investment on behalf of everyone involved in the ecosystem," said Sameer Merchant, vice president of product development at Autodesk.

"But that's a much smaller price to pay than the price you pay if exposed to these attacks," Merchant said. "Be prepared to face the upfront investment in order to make sure that downstream you're protected."

Nation-state threat actors are targeting organizations, outstriping the ability of cybersecurity professionals to detect them accurately, according to research from Vanson Bourne, on behalf of Trellix and the Center for Strategic and International Studies. 

The report shows 86% of IT decision-makers believed their organizations had been targeted by a threat actor operating on behalf of a nation-state. But only 27% of respondents were confident in their organization’s ability to determine accurately whether a nation-state or criminal actor was behind an attack. 

Nine in 10 respondents said they would like governments to provide additional support and help protect critical infrastructure. The study is based on a survey of 800 IT decision-makers across the U.S., Australia, France, Germany, India, Japan and the U.K. during November and December 2021.

There is a chasm between the risk presented by nation-state threat actors and the ability of organizations to defend against such sophisticated and patient adversaries. 

The line between certain nation-states and threat actors that operate on their behalf is increasingly blurred, the research shows.

Perpetrators can mask their origin, which provides a certain level of deniability, according to Christiaan Beek, lead scientist and principal engineer at Trellix Threat Labs and John Fokker, head of cybersecurity investigations and principal engineer at Trellix.

"Nation-state threat actors are persistent and mission-oriented, which makes it that much more difficult for private organizations to defend effectively," said Allie Mellen, analyst, security and risk at Forrester. 

While many IT security leaders expressed a high degree of confidence in their ability to trace the source of an attack accurately, the data reveal the hubris.   

Three-quarters of respondents suspect a nation-state actor targeted their organizations in the 18 months prior to the study. But only one-third of respondents had a high degree of certainty .

Lisa Monaco, deputy attorney general at the U.S. Department of Justice, said criminal hacking groups were increasingly working more closely with nation-states, during a roundtable on cybersecurity in October 2021, according to the report. These alliances make it far more difficult to discern between a pure nation-state attack as opposed to a proxy attack that uses a criminal group for cover. 

Critical infrastructure providers have been on guard for months amid the increased threat of attacks linked to Russia's war in Ukraine. The FBI, National Security Agency and Cybersecurity and Infrastructure Security Agency have repeatedly warned critical infrastructure providers about the risk of ransomware or state-sponsored attacks against energy, telecom or other sensitive targets in the U.S. or NATO allies. 

Unlike criminal actors, nation-state threat actors are not motivated by financial gain and have a great deal of sophisticated resources and patience. As was seen during the SolarWinds attack, blamed on Russia, nation-state actors can lurk inside a compromised network for months without detection. 

If there is one predictable constant in cybersecurity, it's the omnipresence of ransomware. As Mandiant put it best, "There's no end in sight for ransomware."

But don't expect ransomware to continue as we know it today. Mandiant predicts threat actors will develop new ways to gain a profit from ransomware, starting with a shift to globalized attacks.

"Indictments, arrests, seizures of funds, and cyber offensive operations against threat actors and their infrastructure by U.S. law enforcement will cause threat actors to reevaluate which countries they target," said Charles Carmakal, SVP and CTO with Mandiant.

The common thread around these trends is cybercriminals finding a way to manipulate corporate data, and for that problem, there really is no end in sight. As 2022 unfolds, here are four cyberthreat trends to watch: 

Paying ransom won't stop data publication

Paying a ransom probably won't stop threat actors from placing stolen data on the dark web or using it for extortion purposes, Mandiant warned. That's because of infighting in cybercriminal rings.

"Often, conflict arises within these groups as a specific actor may feel like they're not getting paid their fair share," said Carmakal. 

To retaliate, the disgruntled threat actor in the group could decide to publish some or all of the data after the ransom is paid. As greed around ransom grows, expect it to impact post paid-ransom behavior. Individuals could break away from the group and hold the data ransom multiple times. 

"The more this happens, the more it's going to affect the way organizations think about making ransom payments," said Carmakal.

Ransomware as espionage

There has been at least one international cyberattack conducted as an act of espionage in 2022. As tensions between countries escalate, Carmakal also anticipates governments will leverage ransomware in extortion operations.

Threat actors will use masquerading ransom or extortion operations to disguise the objectives of some intrusions, especially when there is conflict between nations.

Attacks on the software supply chain

This year, cybersecurity experts are sounding the alarm on attacks to the software supply chain, especially after 2021 ended with the Log4j flaw. 

"Log4j is not the first or last software supply chain vulnerability, but it is by far the most widespread and easy to exploit weakness that we've seen in many years — including SolarWinds," said Kumar Saurabh, CEO and co-founder of LogicHub. 

The Log4j vulnerability impacted the logging feature of Java, which runs on billions of devices, especially internet of things (IoT) devices, many of which have some form of logging enabled. Seeing how vulnerable these ubiquitous and often ignored codes are in open source software, threat actors will up the ante and go after other forgotten code to exploit.

"What's critical now is careful monitoring of logs from all possible security tools. Unfortunately, many security teams are already flooded with security alerts, and often don't monitor all logs because of excessive storage costs with many SIEM tools," Saurabh. 

It is another type of attack that could be attractive to nation-states looking to infiltrate governments or wreak havoc on the systems that control the critical infrastructure. A powerful zero-day exploit can fetch top dollar on the black market, but it might be worth even more if it remains closely guarded in the toolbox of a sophisticated APT team, including those sponsored by a nation-state, ready to be deployed surgically without attracting too much attention. 

SMBs lack the manpower for in-house monitoring or keeping track of the open source software supply chain. Nor can they analyze or reverse-engineer every software update a vendor sends them. Zero trust models may be the ultimate solution for this style of attack.

"Adopting the ‘assumption of breach' philosophy combined with an asset-based risk management and risk transfer program may be the only way to keep up with the bad guys," said Daniel Schwalbe, CISO at DomainTools.

Quiet attacks

While many cybercriminals tend to pursue high-profile attacks designed for financial gain, threat actors are increasingly trying to infiltrate companies and go unnoticed for a long period of time. These quiet attacks allow cybercriminals to exfiltrate data from servers and endpoints at a slow and steady pace.

In today's hybrid/remote work reality, the information on remote computers is typically less protected, putting it at higher risk for a stealth attack.

"Quiet threats are on the rise because cybercriminals are well aware of the value of data to business and other organizations," said Nigel Thorpe, technical director at SecureAge.

In 2022, expect email and other messaging systems to be the most popular point of entry for these quiet attacks, with the goal of compromising corporate communication systems. Cybercriminals can then infiltrate the corporate network and do damage from the inside without discovery.