Expert Pitch
Arizona State University (ASU)

Colonial Pipeline Hack Is Latest Example of Cybersecurity Threats to Physical Infrastructure

Growing ransomware business model poses a threat to more than just information networks

Editor's Note: On Wednesday, May 12, the White House issued a new executive order that aims to improve U.S. Cybersecurity.  Nadya Bliss, executive director of the Global Security Initiative at Arizona State University, is available to answer questions about the content and scope of the order.

Colonial Pipeline Co., which operates 5,500 miles of pipeline that delivers 45% of gas and jet fuel to the East Coast of the U.S., was shut down on May 7 by an organization now identified as the ransomware group DarkSide.

DarkSide has issued statements since the attack noting that it is an apolitical group with a goal “to make money, and not creating problems for society.” It follows the ransomware-as-a-service (RaaS) business model.

“Ransomware is hugely profitable,” said Nadya Bliss, executive director of the Global Security Initiative at Arizona State University. “Considering the amount of money involved, It’s not surprising that some groups would establish a business model selling ransomware as a service.

“The trend has escalated as technology development and adoption have outpaced policies and regulations, which contributes to cyber vulnerability,” she said.

According to Homeland Security adviser Elizabeth Sherwood-Randall, the hackers broke into networks devoted to the company’s business operations but did not reach the computers that control the physical infrastructure that transports gasoline and other fuel.

Colonial shut down the network as a precautionary measure and has called in external cybersecurity experts to ensure the hack is not dangerous to the overall network.

According to Sherwood-Randall, “Our nation’s critical infrastructure is largely owned and operated by private sector companies.”

“We’re finding ourselves more frequently in an interesting space — the intersection of federal and private jurisdictions where security regulations may be different,” said Bliss. “At a national level, we’re still trying to figure out what policies make sense in the context of cybersecurity.”

Prior to the Colonial hack, the Biden administration had already launched an initiative to improve the cybersecurity of critical infrastructure, focused on high-priority collaboration with private sector partners to harden defenses, according to Sherwood-Randall.

But the broader perspective, according to Bliss, is that domains that don’t typically see themselves in the computer science space — schools, hospitals, utility companies and, in this case, pipelines — are becoming increasingly at risk from outside attacks.

“Some of these entities don’t have in-house security staff trained to assess and thwart risks,” Bliss said. “The need to have dedicated cybersecurity protocols has become increasingly important as more sophisticated versions of software-based attacks are developed.”

Bliss shared some insights about who is vulnerable to ransomware and ways to protect data from attack.

Question: What is ransomware?

Answer: Ransomware is a type of malicious software that encrypts the data on your hard drive and prevents access until the responsible hackers are paid to release your data. It’s like putting it behind a lock – and you can’t unlock it until you pay the fee. In some cases, the hackers not only lock your data, they threaten to make sensitive information publicly available.

Common targets have been schools and health care providers. For example, hospitals can’t access medical records unless they pay the ransom. Because this data is critical to their operation, they are motivated to pay the fee.

Q: Who is most vulnerable to these attacks?

A: First, everyone is vulnerable to some extent, because of the human factor. Cybersecurity is not only about having the most up-to-date technology, it’s about making sure people understand the risks and practice good cyber hygiene, like avoiding clicking on phishing emails and setting strong passwords.

With that said, older systems that don’t update regularly are particularly vulnerable to ransomware attacks.

Q: How can businesses and municipalities protect themselves?

A: Engage in good cyber hygiene:

  • Back up your data regularly on a separate system that is not connected to the internet. This will give you access to your critical data if your systems are unavailable due to encryption or other attack.
  • Adopt a proactive security profile — don’t assume you won’t be hacked. If you leave the door open, at some point someone will come in. And, the more enticing your house is, the more attractive you are as a target.
  • Update your software on a regular basis — software companies are monitoring for vulnerabilities and providing patches and updates that secure against threats as they become known. When the software no longer offers updates, it’s likely time to reconsider the platforms you are using.
  • Recognize cybersecurity as a cost of doing business. Skimping on it may end up costing you much more in the long run.
  • Don’t click on downloads you aren’t expecting or that aren’t from a reliable source. Doing so can end up subjecting your entire system to malware.
  • Seek out support and resources from experts. During the COVID-19 pandemic, for example, the American Hospital Association and the Department of Homeland Security partnered to protect hospitals from malicious activity.
  • Take advantage of resources from trusted sources like the Cybersecurity and Infrastructure Security Agency, which, among other things, provides extensive ransomware guidance and resources and generally tracks vulnerabilities.

Q: With much of America’s critical infrastructure managed by private companies, what can the U.S. federal government do to improve security?

A: Improved policies and regulations can help set basic standards for cybersecurity of critical infrastructure. For example:

  • Create a national information gathering and sharing mechanism that will enable all components of the country’s infrastructure ecosystem — whether in the public or private sector — to get real-time updates of the latest threats and suggested security measures.
  • Incentivize adoption of cutting-edge research into practice.
  • Standardize educational resources and training for local governments and companies.
  • Provide educational resources and training to local governments and companies.
  • Work closely with international partners to better understand the evolving threat landscape. Cyber doesn’t care about physical borders between countries. It’s important that these attacks are tracked broadly and that we share information on a global level.

Filters close

Showing results

110 of 6019
Released: 16-Jun-2021 1:10 PM EDT
Establishing Juneteenth As National Holiday is Opportunity to Create "New America"
Binghamton University, State University of New York

The Senate has unanimously passed a bill to establish Juneteenth, a holiday commemorating the end of slavery in the United States, as a federal holiday. This is an historic moment and an opportunity to create a “new America,” according to Anne Bailey, professor of history at Binghamton University, State University of New York and director of the Harriet Tubman Center for the Study of Freedom and Equity.

Newswise: Keeping the peace
Released: 14-Jun-2021 5:55 PM EDT
Keeping the peace
Washington University in St. Louis

New research from Washington University in St. Louis sheds light on how — and in what context — peacekeepers can contain the spread of violence in fragile post-conflict areas.

Released: 8-Jun-2021 12:45 PM EDT
2021 Gov Race is Currently Murphy’s to Lose
Rutgers University-New Brunswick

Governor Phil Murphy currently has a clear path to reelection victory, according to the latest Rutgers-Eagleton Poll.

Newswise: Political science professors sign statement warning of threats to US democracy
Released: 8-Jun-2021 12:10 PM EDT
Political science professors sign statement warning of threats to US democracy
University of Notre Dame

Five University of Notre Dame professors who specialize in different areas of democracy studies recently signed a strong statement of concern issued by the think tank New America warning of the serious threats to democracy in the U.S.

Released: 7-Jun-2021 2:15 PM EDT
Murphy’s Pandemic-High Ratings Ease; High Marks on Handling of the Pandemic Continue, Taxes Still a Sore Spot
Rutgers University-New Brunswick

– More than a year into the coronavirus pandemic, Governor Murphy’s once-skyrocketing ratings have now returned to pre-pandemic levels, according to the latest Rutgers-Eagleton Poll.


Showing results

110 of 6019

close
2.0007