Critical Infrastructure and Cyber Physical Systems: Importance of Being Prepared

The recent disruption of a critical communications infrastructure gave us a taster on what is it like to have an important facet of our daily lives taken away from us for a few hours. The disruption rippled through nationally from small businesses to critical services such as transportation and emergency services. Similar scale disruption can also originate from cyber attacks, especially when threat vectors target Critical Infrastructure (CI) and Cyber Physical Systems (CPS).

At the time of this publication, the communication service is restored. It’s a good time to ask ourselves, what are the lessons learnt from this event? How can we be more resilient and respond to a cyber event on a similar scale.

There are several frameworks and best practices to strengthen resilience in preparation of a cyber attack event. Initiatives such as establishing governance and risk services, asset identification, assessing security risk posture, implementation of priority controls, response planning and recovery drive resilience. However, it is important to note that in CI and CPS, availability is a top priority and greater emphasis will need to be applied.

On a resilience note, having a response team and a response plan in place can make a difference between unrecoverable reputational damage and leadership through transparency. A well-developed plan that includes the identification of critical cyber-physical assets, threat detection, analysis, investigation, containment and remediation processes provides mechanism to place you in a better position in the event of a breach. With custodians of CI and CPS, this is particularly crucial as in the event of a cyber incident, impacts on our way of life are a clear and present risk.

"Planning without action is futile; action without planning is fatal."
— Cornelius Fichtner

Action and practice against a plan! From my years of observations, it is always interesting to note how some executives can remain calm and collected in the face of media barrage and public pressure, whereas others faired poorly. There is no secret formular. Practice makes perfect, the behavioural response comes from planning, action and practice.

Desktop exercises is key to that practice by providing different high-risk scenarios specific to the threat landscape of the CPS/CI custodians, this is to make it as realistic as possible. Taking it to another level, some innovative simulation platforms driven by AI and Metaverse provide the immersive “real-life” element to exercises.

These exercises train executives and key stakeholders to respond in a concise manner thus maintaining the reputation of the business, they also identify the gaps in response plan and processes.

SOCI Act provides guidance on the frequency of these exercises, it should be done anyway as a best practice cadence.

Finding the right security-focused consulting partner who has knowledge in cyber resilience coupled with extensive experience in operating in Critical Infrastructure and Cyber Physical Systems is key in guiding you through the complexities of uplifting cyber resilience.

Top 5 Takeaways:

1. Know where your critical assets are
2. Assess your critical infrastructure and cyber-physical system risks
3. Have a working critical infrastructure and cyber-physical response plan
4. Action and practice your plan
5. Understand if you have additional reporting requirements because of your contracts and obligations to legislation