Protecting Critical Infrastructure from Cyberattacks Essential if U.S. is to Remain a Superpower

By Jeff Engle, Chairman and President of Conquest Cyber

The playbook for geopolitical dominance is being re-written thanks to Russia’s invasion of Ukraine. It will change further if, as many anticipate, China attacks Taiwan. What this new playbook will look like will depend on whether the U.S. can maintain its Superpower status in the cyber world. To remain as the world’s premiere power, first and foremost, the U.S. must bolster the cybersecurity of its inadequately protected 16 critical infrastructure sectors.

According to the Cybersecurity & Infrastructure Security Agency, (CISA) “the private sector owns and operates a vast majority of the nation’s critical infrastructure.” In fact, there are over 400K private industry players operating within the 16 critical infrastructure sectors in the United States. This decentralized operational framework may collapse in the coming years as it faces an unrelenting, 24/7 onslaught of cyberattacks from other nation-states and their proxies.

No regulatory systems enforced by the U.S. government can protect several hundred thousand companies dispersed across 16 sectors. The attack surface is simply too large to defend. Yet, relying on individual firms to protect themselves is unwise since many firms are undermanned and unequipped to properly protect themselves from cyber threats. Additionally, private sector companies must play a balancing act between embracing secure cyber practices and attaining their business objectives. They cannot simply accept cybersecurity measures that will shut them off from the surrounding world. They must drive towards profitability, and connectivity to global partners is necessary achiever that, leaving them exposed digitally to bad actors. The narrative of events surrounding Russia’s invasion of Ukraine demonstrate that the U.S. critical infrastructure sectors will play a central role in global cyber warfare.

The month of March witnessed a sharp increase in cyberattacks against the financial sector, specifically U.S. banks like JP Morgan, Citigroup, Bank of America, and Goldman Sachs. Yet, this bombardment is only the most recent example of a cyber warfare strategy that began months ago when Russia and its quasi governmentally-backed groups demonstrated their ability to impact the U.S. critical infrastructure sectors by attacking Colonial Pipeline, which “connects refineries from the U.S. Gulf Coast to more than 50 million people in the South and East.” As a United States Army Special Operations Command veteran, I recognized at the time that the ransomware attack was a “shot across the bow,” a way to warn the U.S. that if they can hit Colonial, they can just as easily disrupt the nation’s food and agriculture businesses, delay financial transactions resulting in a loss of trust in the world’s banking system, or perhaps even alter the sodium chloride content in the U.S water supply by hacking the nation’s water management districts. In other words, nothing is safe.

Some television commentators have attempted to assuage the financial community over the past few days by explaining that the recent cyberattacks against American banks lacked complexity. Don’t be fooled. Russia’s attacks lacked complexity because they had no need, in poker parlance, to show their hand. Their goal is close to achievement: they have demonstrated their ability to reach the U.S. critical infrastructure sectors by attacking Colonial Pipeline and others (SolarWinds, Scripps Health, etc.), and despite the objections of the U.S. and the international community are only weeks, perhaps days, from conquering Ukraine.

And make no mistake: the international community has taken notice, perhaps China most of all. Should they consider attacking Taiwan, China will remember which nations supported Ukraine and which private companies took action against Russia. Both will be factors in the calculus of whether China will move against Taiwan and when.

The U.S. has served as a stabilizing force for the international community for most of the past century. For it to remain so the private sector must join with the U.S government to install the necessary protections, detections, and response mechanisms to create a cyber-resilient critical infrastructure sector. A resilient cyber defense will allow the U.S. to protect itself and its democratic way of life while providing its allies with the confidence that any updated playbook for geopolitical dominance will not be published without the U.S. serving as its final editor.

About the Author

Jeff Engle is Chairman & President at Conquest Cyber where he brings a broad spectrum of experience in Risk Management, National Security, and Business Process Optimization. He is responsible for the development and implementation of all strategic initiatives including cyber risk management and secure digital transformation programs. He has served as a consultant for the Department of Defense’s premier adversary emulation team and has conducted vulnerability assessments and training all over the world.

Prior to joining Conquest, Jeff served as Vice President & General Manager of Federal at United Data Technologies, Inc. where he spearheaded the growth and development of the federal business unit, led the contracts, and legal department. He is a veteran of the United States Army Special Operations Command, a former senior vice commander, Military Order of the Purple Heart, and current Advisory Council member for Mission United. Jeff has received two awards of the Bronze Star, the Meritorious Service Medal, two awards of the Joint Service Commendation Medal, the Army Commendation Medal for Valor, and more. He holds a master’s degree and a graduate certificate in Policy Analysis from Virginia Tech, as well as a Certificate from Harvard in cyber risk management, a Certificate in Cloud Security Knowledge (CCSK), is Certified in Risk and Information Systems Control (CRISC) and is a Certified Information Security Manager (CISM).

Jeff Engle can be reached online at donald@pinksharkpr.com, @ConquestCyber on Twitter and at our company website https://conquestcyber.com/

FAIR USE NOTICE: Under the “fair use” act, another author may make limited use of the original author’s work without asking permission. Pursuant to 17 U.S. Code § 107, certain uses of copyrighted material “for purposes such as criticism, comment, news reporting, teaching (including multiple copies for classroom use), scholarship, or research, is not an infringement of copyright.” As a matter of policy, fair use is based on the belief that the public is entitled to freely use portions of copyrighted materials for purposes of commentary and criticism. The fair use privilege is perhaps the most significant limitation on a copyright owner’s exclusive rights. Cyber Defense Media Group is a news reporting company, reporting cyber news, events, information and much more at no charge at our website Cyber Defense Magazine. All images and reporting are done exclusively under the Fair Use of the US copyright act.