Protecting Critical Infrastructure Against Cyberwar

If you knew your loved ones or friends would be impacted by a serious illness and you had the ability to prevent it, would you? This question posed by Michael Stephens, General Counsel, EVP Information Technology, Tampa International Airport, was just hypothetical, but it raised a very valid point about cyberattacks. Probably everyone in the room was thinking, “Of course!” But, this is the case with cyberattacks, as well, and everyone is NOT doing something to prevent it. “There are vulnerabilities out there for all of us. It is spooky, spooky out there… and people don’t want to hear it,” said Stephens. “We can help prevent what is inevitably going to happen.”

Moderator RJ Steenstra, President and CEO, Fort McMurray Airport Authority, has first-hand experience with “the inevitable.” In 2016, ransomware called Dharma shut down the administration servers for nine full days, he said. Complete reprogramming was required, which took 6-8 weeks. “We were lucky, though,” he said. “It didn’t compromise data.” 

And, and in this day and age, “Data has become the new gold bullion,” said Stephens. And the enemy that is trying to cripple the industry uses computers, keyboards and kiosks for tools. However, and as Michael Yip, VP, Risk Management Dallas Fort-Worth International Airport, pointed out, “It is one thing to understand there is a problem, another to address it.” At DFW, they take a holistic view of cybersecurity as “you have to understand the interconnectivity of it all.” Their organizational resiliency framework consists of Recognize, React, Respond and Recover. 

For Terrance Kirk, Vice President, Aviation Information Sharing and Analysis Center (A-ISAC), the best way to combat cyberattacks is to “provide situational awareness, where companies can share cyberthreat security indicators in a non-competitive way,” which is where A-ISAC comes in. A-ISAC has the goal of “building a more cyber-resilient industry” and is actively engaging in partnerships worldwide in order to establish that framework. 

The key is to understand that it is a real problem. “We are dealing with a very evolving and persistent threat,” said Stephens. “They are like ticking time bombs.” Airports may see millions of attacks each year. There is a probability some are going to get through. “We need to start adopting a standard at our airports. Otherwise, they will set it for us,” he explained. This would allow us to assess the risks, costs and benefits. “If I can leave you with one thing: Make sure you are having a dialogue about a standard to adopt.”