![\"\"](\"https:\/\/www.armytimes.com\/resizer\/2G-RKWnbHpWlrHynnBUBT6bHaKw=\/1200x0\/filters:quality(100)\/arc-anglerfish-arc2-prod-mco.s3.amazonaws.com\/public\/3IWN5ZHZONE2ZDHXRD63UCA2KE.jpg\")
The proliferation of internet of things devices tied into critical industries such as transportation and healthcare is changing the perspective on what constitutes critical infrastructure, according to government and industry experts who spoke at the 2017 CyberCon.<\/p>\n<\/div>\n<\/div>\n
\u201cThe attack surface is going to expand greatly,\u201d said Ret. Maj. Gen John Davis, vice president and federal chief security officer at Palo Alto Networks. \u201cWhen we start connecting all of these other devices, like devices that are involved in life-saving functions \u2013 transportation, cars \u2013 when we start connecting these things, we\u2019re opening up a whole different category of impact. I think we will put people\u2019s lives at risk, and I think there will be tremendous impact to national security, economic prosperity, public safety. So, I worry about the direction that this is going in.\u201d<\/p>\n<\/div>\n<\/div>\n
According to Jeanette Manfra, assistant secretary in the Department of Homeland Security\u2019s Office of Cybersecurity and Communications, digital devices are changing the meaning of infrastructure that used to refer only to physical systems.<\/p>\n
\u201cIn thinking about critical infrastructure, the word \u2018infrastructure\u2019 itself sometimes, I think, causes some confusion,\u201d said Manfra. \u201cAnd when it was originally established it was around the notion of physical threats, counterterrorism, etcetera, and how are we actually protecting the asset, the infrastructure itself from somebody who might want to sabotage that building or use that infrastructure itself to destroy another infrastructure.\u201d<\/p>\n<\/div>\n<\/div>\n
Instead internet connected devices and systems constitute essential services within parts of the critical infrastructure.<\/p>\n<\/div>\n<\/div>\n
\u201cIt\u2019s not just about the infrastructure, it\u2019s about \u2018what are the critical services and functions that American citizens, residents and increasingly, because of the multinational nature of some of our companies, globally that we depend upon?\u2019\u201d said Manfra.<\/p>\n<\/div>\n<\/div>\n
She added that she divides the cybersecurity problems posed by IoT into three categories: IoT as vulnerable endpoints on a critical infrastructure\u2019s network, consumers buying unsecured IoT devices that could be conscripted into a denial of service or botnet campaign, and IoT devices imbedded in cars or healthcare tools that pose a life-threatening vulnerability.<\/p>\n<\/div>\n<\/div>\n
\u201cI think that\u2019s a very different set of issues,\u201d Manfra said.<\/p>\n
\u201cMore and more things are connecting to each other, and we\u2019re becoming more and more reliant on that connectivity,\u201d said Davis. \u201cAnd so I think that what that\u2019s going to result in is difficulty in prioritization of effort.\u201d<\/p>\n<\/div>\n<\/div>\n
James Scott, senior fellow at the Institute for Critical Infrastructure Technology, said that a cybersecurity vetting system, much like how products are rated for energy efficiency, could solve the problem of consumers buying unsecured devices.<\/p>\n<\/div>\n<\/div>\n
\u201cOne of the easiest ways to manage that is an EnergyStar-type approach, so you have the device, you have a QR code, you scan your phone over the QR code. That then feeds back to a dynamic database that\u2019s operated by machine learning and artificial intelligence that calculates a score,\u201d said Scott.<\/p>\n<\/div>\n<\/div>\n
Scott added that the critical infrastructure sectors most vulnerable to cyberattack, like healthcare and energy, tend to have \u201cFrankenstein IoT microcosms\u201d of unsecured devices.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n