1.6 Cyber Security of Critical Infrastructure☆

# When the Lights Go Out

• In October 2020, Mumbai lost power for hours. Local trains froze mid-journey.
• Hospitals switched to generators, and offices across the city stopped.
• Police suspected a cyber attack; it was never proved.
• Which systems can stop a whole country, and how are they protected?

# Critical Infrastructure

Critical infrastructure is the set of systems and assets so vital that their failure would seriously harm national security, the economy, public health or safety. Critical information infrastructure (CII) is the computer systems that run them.

CII and protected systems in the IT Act

• CII (Section 70): a computer resource whose incapacitation or destruction would have a debilitating impact on national security, economy, public health or safety.
• Protected system: the government can declare a CII a protected system; unauthorised access to it is punishable with up to 10 years in prison and a fine.

SCADA and ICS

• ICS (industrial control systems): computers that control machines in power plants, pipelines and factories.
• SCADA (supervisory control and data acquisition): the type of ICS that monitors and controls equipment spread over a large area (a grid, a pipeline) from a control room over a network.

Sectors

• NCIIPC's sectors: power and energy · banking, financial services and insurance · telecom · transport · government · strategic and public enterprises.
• Also vital: health, water supply and defence.

Why they are targeted

1. Huge impact: one attack can hurt millions of people at once.
2. Old systems: many SCADA systems were built decades ago, without security.
3. Now connected: once isolated, these systems are now linked to office networks and the internet.
4. Hard to patch: a power plant can't be shut down every week for updates.
5. Attractive to states and terrorists (→ 1.5).

Threats

• SCADA and ICS weaknesses · legacy software · APTs · ransomware · insiders · compromised suppliers · physical break-ins.

Real attacks

1. Stuxnet (2010): damaged centrifuges at an Iranian nuclear plant (→ 1.5).
2. Ukraine power grid (2015): about 230,000 people without power for 1–6 hours.
3. Colonial Pipeline (May 2021): ransomware shut down the largest fuel pipeline in the US for about five days; the company paid about 4.4 million US dollars in ransom.
4. Mumbai outage (2020): a suspected cyber sabotage, still disputed.

Consequences: one failure spreads

flowchart TD
    P["<b>Power grid fails</b>"]:::red --> T["<b>Telecom, internet</b><br>go down"]:::amber
    P --> H["<b>Hospitals, water pumps</b><br>on backup power"]:::amber
    T --> B["<b>UPI, ATMs, banking</b><br>stop"]:::red
    H --> S["<b>Public safety</b><br>at risk"]:::red
    classDef amber fill:#d6a24424,stroke:#d6a24480
    classDef red fill:#d0707024,stroke:#d0707080

• Cascading failure: sectors depend on each other, so one failure brings down others.
• Public safety, the economy and trust in government are all hit.

# Protecting Critical Infrastructure

Measures inside each organisation

1. Risk assessment: find the most critical systems and their weak points (→ 4.9).
2. Segmentation and air gaps: keep control systems separate from office networks and the internet.
3. Monitoring: intrusion detection on control networks, watched 24 × 7 (→ 6.7).
4. Patching and secure settings, planned around maintenance windows.
5. Strong access control: MFA, least privilege, no shared passwords.
6. Incident response and backups: a tested plan to restore operations quickly.
7. Staff training, including against phishing.
8. Public–private partnership: private companies run most infrastructure, so they share threat information with the government.

National-level protection

1. NCIIPC (National Critical Information Infrastructure Protection Centre): created under Section 70A on 16 January 2014; a unit of NTRO; the national nodal agency for protecting CII.
2. CERT-In (formed 2004; statutory under Section 70B): handles cyber incidents nationally. Since 2022, organisations must report specified incidents to it within 6 hours.
3. Sector CERTs, such as those for the power sector, handle incidents in their own sector.
4. National Cyber Security Policy 2013: called for NCIIPC, a 24 × 7 CERT-In and the training of 5 lakh cyber security professionals.