Industry executives and experts share their predictions for 2022. Read them in this 14th annual VMblog.com series exclusive.
Securing the Critical Infrastructure that Powers the U.S.
By Josh Lospinoso, CEO and co-founder, Shift5
From SolarWinds to the Colonial Pipeline, cyberattacks against critical infrastructure have dominated headlines in the last year. While the Biden Administration is placing increasing focus on bolstering the country’s cybersecurity posture, securing operational technology (OT) will be crucial to ensure the smooth operations of electrical grids, water treatment facilities, public transit systems and other critical infrastructure.
In the year ahead, I expect to see a few growing trends continue, and new challenges emerge that will require collaboration across government and industry organizations to secure the country’s most critical infrastructure.
Cyber privateering will expand beyond Russia: Russia has perfected the art of cyber-privateering – enlisting the aid of private threat actors and groups that aren’t formally sanctioned, but are secretly supported by the government. In exchange for launching cyber attacks against Russia’s enemies, the Russian government turns a blind eye to the other hacking the private groups do for their own personal profit. Meanwhile, Russia is able to claim innocence as it maintains political distance from the attacks. Over the next year, we will see other nation-states, such as China, Iran, or North Korea, emulate this model to advance their cyber capabilities.
Adversaries will seek to topple the Jenga tower of code that is American software: The hasty cloud migration the pandemic prompted has increased the layers of software stacked on existing software, creating a Jenga tower of code that can easily be toppled if one piece is tweaked. We saw this with the SolarWinds and Kaseya attacks, and most recently Zoho, and we’ll continue to see even more such attacks in the new year as attackers move up the software supply chain.
Zero-days will target OT systems: Cybercriminals are rational economic actors, and they’re seeing that physical effects of cyberattacks (like those experienced by Colonial Pipeline) can result in 7- and 8-figure payouts. Thanks to the interconnected nature of digital components, operational technology is deeply embedded within the digital landscape. The result is that attacks – even from the IT side – have become much more devastating. When OT assets can’t operate, operators lose money very quickly and are often desperate to get back up and running. In 2022, we will see threat actors narrow their efforts to capitalize on these issues. These systems were never designed with a witting cyber adversary in mind – they were designed to maximize safety and availability against a wide range of physical operating conditions. We must expect and prepare for an onslaught of cyber-physical ransomware attacks and exploitation of zero-days in OT systems.
The U.S. government will push cybersecurity measures for transportation: The U.S. government has historically been unwilling to mandate cybersecurity measures for organizations and critical infrastructure. New policies in the form of Executive Orders were created this year in response to SolarWinds and the Colonial Pipeline attack spurred the Transportation Security Agency (TSA) to implement new cybersecurity requirements for pipelines. Given how fast the transportation and other sectors are incorporating digital systems and how successful attackers have been targeting critical infrastructure, there will be moves within the U.S. government to be more proactive in proposing cybersecurity measures for key sectors.
Autonomous transportation assets will be the next attack vector: As transportation vehicles on roads, rail lines and in the air become more autonomous they are increasingly at risk of cyber attack. Western Australia’s mainline rail network is now fully-automated and more planes and helicopters are unmanned, which means they can be remotely controlled. Aircraft, trains and ships today run on data which can be remotely accessed. Once an attacker can take control of a transportation operation system or manipulate data on its internal communications network, there’s little to no security. The danger of sabotage and destruction is real. We will need robust security on these systems that lack a human layer of protection.
Machine learning will power the next wave of cybersecurity innovation: The security practices of patching vulnerabilities, requiring passwords, and listing known signals of bad actors do not adequately enable organizations to keep up with the rapidly-evolving threat landscape. Machine learning can help move the industry forward – particularly because it provides the ability to identify previously unknown bad activity. In 2022, we will see a surge of innovation as vendors apply machine learning to a range of persistent cybersecurity problems, such as phishing attacks, unusual network traffic and business email compromises. We’ll also see machine learning models used in non-security disciplines like computer vision and reinforcement learning applied to old cybersecurity problems, such as detection of phishing attempts and endpoint protection.
In 2022, the public-private partnership between the government and private security companies will be rebuilt. With the federal government taking a more proactive approach to cybersecurity in both the private and public sectors, cooperation with industry organizations will increase. Collaboration will be key to securing the critical infrastructure upon which the United States relies.
##
ABOUT THE AUTHOR
Josh Lospinoso is the Chief Executive Officer of Shift5, which he joined in 2019. Shift5 is a transportation data company whose customers run smarter, safer, and more efficiently by unlocking their fleet’s data. Their data-driven solutions integrate directly onto existing platforms, collecting and enriching data from all of their electronic components.
Prior to joining Shift5, Lospinoso was the CTO of RedOwl Analytics and served in the U.S. Army as captain for 10 years. He remains a Venture Partner of First In. Lospinoso has a doctorate in Philosophy and Statistics from the University of Oxford and a bachelor’s degree in Economics from the United States Military Academy at West Point.
