Protecting critical infrastructure: Mapping and patching CVEs is not enough for robust defense

Oakley Cox, Principal ICS Analyst | Thursday August 26, 2021

Cyber-attacks targeting water facilities, pipelines, and other forms of critical infrastructure pose a serious threat to national and economic security, as well as public and environmental safety. In response to recent high-profile attacks, the Biden administration spearheaded several initiatives for protecting US critical infrastructure. These efforts include the National Security Memorandum on Improving Cybersecurity for Critical Infrastructure Control Systems and the cyber security funding in the bipartisan infrastructure bill.

While increased public focus and funding are urgently needed, they are only the first steps in achieving stronger security for critical infrastructure. For these efforts to be successful, the Biden administration needs to turn its focus to cutting-edge capabilities and direct its funding toward sophisticated technologies that can achieve these ends.

Focusing on achieving the right security capabilities

For years, the security community for operational technology (OT) and Industrial Control Systems (ICS) has put a strong emphasis on mapping and patching common vulnerabilities and exposures (CVEs). While this vulnerability tracking is often necessary, mapping and patching vulnerabilities alone is not a sufficient strategy to arm organizations against attacks.

First, known vulnerabilities simply do not represent all risks, as attackers frequently leverage unknown vulnerabilities called zero-days and misuse legitimate operations in ways that cannot be trivially recognized as malicious. This is particularly true for control system environments, with one-third of ICS flaws designated as zero-days when disclosed.

Devices with zero or few known vulnerabilities may also simply lack specific research into them, rather than being more secure. For example, millions of devices are put at risk by a recently discovered vulnerability in control systems used in building systems — including heating and air conditioning — and this also affects PLCs widely used in manufacturing and energy utilities.

Rather than merely tracking and patching CVEs, Biden’s recent National Security Memorandum realigns OT security to place focus onto the right security goals. The memorandum candidly addresses the problem with vulnerability tracking and other legacy security approaches, as this document affirms that “we cannot address threats we cannot see.”

Investing in the right security technologies

The memorandum specifically focuses on “facilitating deployment of technologies and systems that provide threat visibility, indications, detection, and warnings, and that facilitate response capabilities” for ICS and OT. The next step in achieving these aims is to identify the technologies that can provide these capabilities.

By learning a sense of ‘self’ from scratch for every human, device, and the whole ecosystem of an organization, Self-Learning AI autonomously implements machine-speed detection, investigations, and response. This solution is particularly effective at stopping ransomware before operation disruption, which would have allowed Colonial Pipeline to avoid manual shutdowns.

AI is also uniquely capable of thwarting insider threats. It could have immediately identified the threat in the Florida water facility incident, as its understanding of the ‘pattern of life’ for every user, device, and all the connections between them would have illuminated the insider’s subtle unusual behavior.

The sensitivity and essential nature of critical infrastructure demand the most sophisticated technologies for robust cyber defense. Fortunately, Self-Learning AI technology is already available and currently used by all 16 critical infrastructure sectors designated by CISA. As the threat continues to grow, and the Biden administration’s efforts are pursued more aggressively, Self-Learning AI stands ready to safeguard the systems that our society relies on.

National Security Memorandum goalsDarktrace capabilities
Threat visibilityVisibility across entire ecosystem, including all Purdue levels and into/around the DMZ.

Protocol and technology agnostic, adapts to bespoke environment.
IndicationsThreatening activity highlighted, even when this doesn’t align with pre-defined IoCs.

Understands context in addition to content of human and machine-to-machine communications.
DetectionsSelf-Learning AI understands unusual behavior, rather than rules and signatures.

AI detections ranked by criticality, such that most threatening behavior is foregrounded.
WarningsAI investigations stitch together events into incident reports with attack phases.

Incident reports surface the scope and severity of a security incident, including possible consequences and advice for remediation.
Facilitating responseAutonomous Response surgically neutralizes threats at their earliest stages.

Response is highly configurable, available in active or human confirmation mode.

Learn how AI defends critical infrastructure from ransomware

Oakley Cox

Oakley Cox is one of the rising stars of Darktrace’s Cyber Analyst team. Based at the Cambridge Headquarters, he oversees the defense of critical infrastructure and industrial control systems, helping to ensure the Darktrace AI stays one step ahead of the attackers. Oakley is GIAC certified in Response and Industrial Defense (GRID), and helps customers integrate Darktrace with both existing and new SOC and Incident Response teams. He also has a Doctorate (PhD) from the University of Oxford.