that the great deal that the vendor is giving you will quickly be offset by the costs
associated with a cyber vulnerability that is exploited.
• Implement strong internal controls and tightly monitor. Executives in critical
infrastructures need to safeguard their systems to ensure public health and safety,
protect the environment, and maintain economic stability. You can’t let your
guard down and must maintain constant vigilance. Make sure you have strong
internal controls that give you the ability to monitor and control your key
processes and procedures. Don’t solely rely on automated systems and their
reports. Factor in human monitoring and control mechanisms too. Your internal
controls should maintain defense-in-depth principles with checks from primary
and secondary systems.
• Identify and have a plan to address all single points of failure. Single points of
failure are items in a system where an item malfunction or failure could cause the
entire system to fail. Systems that require high availability are frequently built
with redundant components and subsystems to insure that the system continues to
function in the event of a failure of a component or subsystem. A common single
point of failure in your house is your electrical power. Many people mitigate this
single point of failure by installing uninterruptible power units and generators to
provide continuous power to their critical electronics such as medical devices,
computers, and (sometimes) their televisions. Critical infrastructures typically
can’t afford to have single points of failure, which could have catastrophic effects.
Primary and secondary systems are normal configurations. If you are involved in
critical infrastructure management, make sure you avoid single points of failure.
Conduct a failure modes and effects analysis of your systems. Identify all potential
single points of failure and analyze your risk to determine whether you need to
mitigate, accept, or ignore the risk of single points of failure.
• Train your personnel. Your people are your most valuable resource and are the
key element in protecting your resources against cyber attacks and exploitation.
A well-trained and focused workforce is best prepared to find and fix vulnerabilities
quickly and efficiently. When your workforce is cyber hardened and “cyber
smart,” they are more likely to recognize unsafe practices and procedures and
detect aberrations that could be the early signs of a cyber attack or probing of
your systems. Invest in your workforce by training them well to understand cyber
threats and vulnerabilities. Teach them the procedures to follow to safely and
securely operate and control your systems. Make sure they understand what to do
when things go wrong including who to notify and when to do it. Empower them
to act like the security guard Kataytsev who understood the situation he faced and
knew what had to be done. Train them well.
• Practice! Many critical infrastructure operators conduct training exercises to
make sure employees, local authorities, and other key stakeholders are familiar
with risks and what to do when “the unthinkable” happens. The authors have
been involved in countless defense, nuclear, and industrial disaster preparedness
exercises and drills that have honed the skills of mission partners across multiple
sectors. Exercises help gauge the effectiveness of plans and training. We believe