Critical infrastructure protection: Top 7 emerging threats

Introduction

Critical infrastructure protection is necessary because society is becoming more and more dependent on complex systems to maintain services like energy, transportation, water supply, healthcare, and communication. 

These systems are often exposed to risks such as supply chain vulnerabilities, cyberattacks, and the effects of climate change.

In addition to the growing issue of extreme weather events endangering the integrity of these systems, recent studies show a 140% increase in cyberattacks targeting critical facilities. 

This article explores the top 7 rising threats to critical infrastructure protection and proposes actionable preparedness measures to increase our critical systems' protection and cyber resilience.

Top emerging threats to critical infrastructure protection (And how to tackle them)

By implementing these methods, organizations can strengthen their defenses against the dangers of cyberattacks.

1. Cyber attacks on critical infrastructure

With increasing interconnectivity, cybercriminals are exploiting vulnerabilities in operational technology systems. This often leads to severe disruptions and potential national security risks.

According to Check Point Research, the three highly targeted sectors were healthcare (1,999 assaults per week), government/military (2,084 attacks per week), and education/research (3,341 attacks per week).

Preparation strategies

1. Implement multi-layered cybersecurity defenses
   • Use firewalls, intrusion detection systems, and regular vulnerability assessments to create a strong defense against cyber threats.
   • Example: The Cybersecurity and Infrastructure Security Agency (CISA) recommends a defense-in-depth strategy for critical infrastructure protection.
2. Conduct employee training on cybersecurity awareness
   • Regular training sessions can help employees recognize and avoid phishing and social engineering attacks.
   • Example: A recent study found that organizations with regular cybersecurity training programs experienced 70% fewer successful phishing attacks.

1. Establish and test an incident response plan
   
   • Develop a comprehensive incident response plan that outlines the steps to take in the event of a cyber breach.
   • Example: The National Institute of Standards and Technology (NIST) provides guidelines for creating and maintaining an effective incident response plan.

2. Climate-related disasters

The increasing intensity and frequency of events such as hurricanes, floods, wildfires, and heat waves are challenging the resilience of infrastructure systems worldwide as a result of climate change. 

The recent State of the Climate report mentioned that the three hottest days ever recorded occurred in July 2024.

Preparation strategies

1. Invest in climate-resilient infrastructure materials and designs
   • Use materials and designs that can withstand extreme weather conditions, such as flood barriers, fire-resistant building materials, and elevated structures.
   • Example: The Netherlands has invested heavily in flood defenses, including the Delta Works, a series of construction projects designed to protect the country from the sea.
2. Conduct a climate risk assessment
   • Identify vulnerable areas within your infrastructure by observing climate change.
   • Example: New York City conducted a comprehensive climate risk assessment to identify areas at risk of flooding and implemented measures for critical infrastructure protection.
     
3. Develop and test emergency response plans
   • Create detailed emergency response plans for natural disasters, including evacuation protocols and communication plans.
   • Example: Japan's rigorous earthquake and tsunami preparedness plans, which include regular drills and public education campaigns, have proven effective in mitigating the impact of such disasters.

3. Supply chain disruptions

Recent events like geopolitical tensions have worsened the global supply chain. 

In the first half of 2024, supply chain disruptions increased by 30% compared to the same period in 2023. This rise was driven by factors such as factory fires, labor disruptions, and extreme weather events.

Preparation strategies

1. Diversify supplierssome text
   • Reduce dependency on a single region or provider, especially for essential components, by sourcing from multiple suppliers.
   • Example:  For instance, Dow Chemical employs a dual sourcing strategy for critical raw materials, ensuring backup options are available if one supplier faces issues. 
2. Maintain an inventory of critical supplies
   • Keep a buffer stock of critical supplies to mitigate the impact of supply chain delays.
   • Example: Automotive manufacturers have started maintaining higher inventory levels of semiconductor chips to avoid production halts due to supply shortages.
3. Use supply chain monitoring tools
   • Implement real-time monitoring tools to track disruptions and enable faster response.
   • Example: A study by TraceX Technologies found that companies using real-time monitoring experienced improved operational efficiency with unforeseen delays.

4. Insider threats

Insider threats, such as sabotage, data theft, and unauthorized access by employees or contractors, pose risks to critical infrastructure protection.

In 2024, 83% of organizations reported experiencing at least one insider attack, a significant increase from previous years.

Preparation strategies

1. Implement strict access control measures
   • Conduct thorough background checks for employees and contractors to identify risks before granting access to sensitive information.
   • Example: Many organizations now use comprehensive background screening processes to vet new hires and contractors.
2. Use role-based access controls
   • Limit employees' access to only the information and systems necessary for their job functions.
   • Example: Implementing role-based access controls (RBAC) ensures that employees can only access data relevant to their roles.
3. Monitor for unusual activity
   • Use advanced monitoring tools to detect unusual activities, such as large data downloads or login attempts from unusual location
   • Example: User and Entity Behavior Analytics (UEBA) tools can help identify anomalies in user behavior.