Critical infrastructure protection: Maybe thinking good thoughts will make us safe

Joe Lieberman (I-Conn.) retired in January after quite a colorful two-dozen years in the U.S. Senate. One of the major issues he pushed for during his last few years in office was protection of the U.S. critical infrastructure. Along with Sen. Susan Collins (R-Maine), Lieberman put forth a series of bills aimed at requiring some level of protection for such infrastructure, the last of these being voted down in November

President Obama has now issued a "Presidential Policy Directive" on "Critical Infrastructure Security and Resilience." This directive was accompanied by an Executive Order on "Improving Critical Infrastructure Cybersecurity." Sadly, the president's efforts may turn out to be about as useful as Lieberman's.

[ RELATED: Obama signs cybersecurity order ]

The senator's efforts ultimately failed because 2012 was an election year. But the big beef against his bill was that it actually called for companies to take responsibility for the risks that they had created. Sen. John McCain (R-Ariz.) headed the attacks saying, "unelected bureaucrats at the DHS could promulgate prescriptive regulations on American businesses, which own roughly 90% of critical cyber infrastructure."

I will admit that the fact that the Lieberman/Collins bill would have put the Department of Homeland Security -- you know, the people that bring you the security theater that is the TSA -- in charge of protecting critical infrastructure made it a lot harder to take the proposal seriously. But the McCain assumption that the folks that run our power plants, hospitals, transportation and financial networks will suddenly wake up on their own and start protecting the infrastructures they have so carelessly and assiduously left exposed strains credibility.

The Obama executive order says that the "critical infrastructure" of concern is "where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security." OK, you got me at "catastrophic ... effects." According to the dictionary that came with my Mac, "catastrophic" means "involving or causing sudden great damage or suffering." The type of things that Joel Brenner wrote about in his book "America the Vulnerable." Lots of people dying, the economy collapsing -- fun things like that.

Right now there is no actual legal requirement that the controls for a power company's plants be secure from hacking. There is also no personal liability for anyone working at the power company if they do not exercise common sense to try to protect against vendor stupidity that builds in security vulnerabilities. Nor is there any liability for a vendor that purposefully decides to make its products insecure and fails to tell customers. 

There are regulations that require hospitals to protect medical records and universities to protect student educational records, but there are none that require a power company to protect its generating capacity or a hospital to protect its physical plant -- which is just as important to patient care as are the records. Imagine, if you will, what might happen to critically ill patients in a hospital in Dallas if the AC was turned off in mid-August. In this case the hacker went to jail, but what about the hospital engineers who installed the AC controllers in such a way that they were accessible over the Internet? In my opinion, they should share the blame.

The Obama effort bows to those in Congress who care less about protecting our health and safety than they do about protecting the pocketbooks of their campaign donors. That is not only sad, but it is a clear and present danger to us all. Prediction: Real requirements and liability will be established in law only after a major example of why it has been needed for years -- i.e., the Federal Aviation Administration style of fatality-based regulating.

Disclaimer: In spite of Harvard's feeling of self-importance I am not sure that any of its facilities would meet an objective definition of critical infrastructure. In any case, I have heard no opinions from the university on this topic, so the above lament about administration and congressional impotence is my own.

Read more about wide area network in Network World's Wide Area Network section.

Join the CSO newsletter!

Error: Please check your email address.

Tags Obama cybersecurity plansecuritySen. Joe Liebermanphysical securitycritical infrastructuregovernmentindustry verticals

More about Federal Aviation AdministrationResilience

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Scott Bradner

Latest Videos

  • 150x50

    CSO Webinar: Will your data protection strategy be enough when disaster strikes?

    Speakers: - Paul O’Connor, Engagement leader - Performance Audit Group, Victorian Auditor-General’s Office (VAGO) - Nigel Phair, Managing Director, Centre for Internet Safety - Joshua Stenhouse, Technical Evangelist, Zerto - Anthony Caruana, CSO MC & Moderator

    Play Video

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

More videos

Blog Posts

Market Place