Jerry Freese: Make Critical Infrastructure Protection a Priority

There's a multidimensional approach to information security in the electric sector. On the business side, we have to protect the corporate networks and data. On the operational side, critical control system security is a mandate from industry groups and regulators. Given the reality of the financial and resource commitments these approaches require, it's often easy to forget that both exist in a larger security context of critical infrastructure protection (CIP).

In today's environment of competing financial requirements, CIP is understandably less a direct driver of security than it is an indirect beneficiary of whatever protection is deemed effective and affordable for business conduct or regulatory compliance. It's not the best situation given that CIP is key to the preservation of the social and economic fabric of our way of life. That would sound like pure melodrama if it weren't so true.

Even so, and in spite of the rhetoric from government and industry groups, the concept of critical infrastructure protection is little more than that…an understated and under-socialized concept, reserved for academics and government planners, lacking any tangible national-level threat to make it a real priority.

What's the reason that a compelling and imperative concept such as critical infrastructure protection hasn't been embraced for its own sake and hasn't prompted actions to ensure its implementation and long term viability? In some respects it comes

Remember that prior to 2001, the electric sector and critical infrastructure in general enjoyed an essentially threat-free environment. Infrastructure assets and systems were largely isolated from one another, and even damage from natural disasters could be localized without fear of major cascading outages. In other words someone would have to "be here" to conduct attacks against the U.S. infrastructure and the impact would probably be limited to specific assets and geographic areas.

Now the situation has changed. With the increased use of the Internet and multiple-system connectivity, the electric grid has become an interconnected and complex system of systems, with benefits of speed, efficiency and relatively low cost associated with its control and growth. From the industry perspective, the benefits were a boon for business and unprecedented growth in the use of advanced technology for grid management and communications.

Security professionals are well aware that these changes come with a significant downside. Previously closed and remotely unreachable systems are suddenly vulnerable to a host of Internet-based malicious activities. It takes little imagination to understand that the critical electric infrastructure, so essential to American society, is suddenly at risk of becoming a prime target of hackers, social activists, nation-states and even terrorist organizations, with potentially society-altering consequences.

Government and industry are attempting to address this technology adoption with cybersecurity standards and proposed legislation mandating a more reliable bulk power system. It's a good start, but the first iterations of these standards only apply to a subset of the electric sector assets. Cybersecurity in the electric sector, which typically requires a comprehensive logical protection scheme across all networks and systems, has started to look a lot more like an exercise in specific, major asset compliance than it does an all-encompassing, risk-based, infrastructure protection strategy. Though this approach is more sensitive to financial requirements and considers the sheer scope of the infrastructure, it still suffers from the lack of true commitment to critical infrastructure protection.

What are the missing ingredients? First, it goes back again to perceived need. For most people, the idea of a potential major cyberattack on critical infrastructure, one that could provide the same net effect as actual physical destruction of assets and services across major geographic areas is difficult to grasp. Because we can't see the threat and haven't experienced any real digital warfare or its effects, we don't mobilize nationally across the public and private sectors and prepare our defenses against it. Contrast that with a hypothetical situation where hostile forces are amassed at a U.S. border or a country has deployed a space-based offensive missile system. The national response would be immediate and decisive. The public would demand effective defensive measures be put in place, just in case the forces mobilized or missiles were fired. Protecting the people and the critical infrastructure would be the primary mission.

That brings us to the final missing ingredients; sufficient awareness of the threat and understanding of what we stand to lose in a major cyber incident. There are numerous individuals and groups throughout the world that are fully capable of launching cyberattacks against our infrastructure. The threat may not be imminent but it can manifest itself very quickly. If we're not actively going to pursue a national (private and public) information campaign and protection strategy, integrating strong security into our essential systems and services, the consequences to our critical infrastructure in the event of an attack could be severe. We need a "just-in-case" mentality for CIP. Our country and our way of life may depend on it.

				SECURITY 7 AWARDS
				JERRY FREESE TITLE Director IT security engineering COMPANY American Electric Power INDUSTRY Utilities KUDOS On the front lines of critical infrastructure protection Defines, develops and executes all information security programs at AEP Coordinator of AEP's compliance efforts around the North American Electric Reliability Corp.'s security eight standards, 41 requirements and 164 sub-requirements AEP's primary data security architect Contributes to NERC and FERC standards development and the energy industry as a whole Member of the NERC Critical Infrastructure Protection Committee Member of the FERC Order 706 Standards Drafting Team. Participated on the Infrastructure Working Group with the Center for Strategic and International Studies (CSIS) Commission on Cybersecurity for the 44th Presidency. Chairman of AEP's Executive Security Committee; committee facilitates major security initiatives company wide. Facilitates NERC CIP compliance efforts on both the technical and regulatory side; managing IT security implementations as well as relaying any new NERC and FERC orders and changes Retired Naval cryptologic officer; experienced in information warfare EDITOR'S PICK Critical infrastructure protection is finally and rightly being elevated as a priority, not only among the security industry, but by the president. The recognition that critical infrastructure is a national strategic asset, in turn, elevates security pros such as Jerry Freese whose efforts go beyond data protection and identity management, and impact national security and our way of life.