Cybersecurity on the Front Lines of Critical Infrastructure

Hi, I'm Joan Goodchild, Contributing Editor with CSO, and welcome to another episode of CyberSessions. We are here today at the CSO Cybersecurity Awards and Conference in Nashville, and I'm thrilled to be joined by Vaughn Hazen. He is the CISO for CNN Rail. Welcome, Vaughn. Thank you.

So let's start by talking about critical infrastructure and systems like rail. They're increasingly kind of part of the discussion of being targets for cyber warfare.

How much of a sort of discussion have you been having as part of your role when it comes to the threat landscape surrounding those kinds of things?

Yeah, Well, I think you have to look at the moment we're in. We have rising geopolitical tensions. There's the conflict in Ukraine, the conflict in Iran, the rising tensions in Asia, or all of those have North American impacts.

And when you think about it, they have increasingly used cyber as a lever to drive their influence and achieve their outcomes in a relatively low risk.

And then you add on top of that, the fact that we have these frontier models that are allowing new capacity to exploit systems that have previously not been exploitable in very short order at a velocity that we've not seen before.

Then you throw on top of that, when you have large industrial critical infrastructure organizations, they typically have a lot of legacy systems that are not as maintained as some of the newer systems.

And it creates kind of a perfect storm for where we are now. And so there is a significant risk.

It's the reason why a lot of governments are engaging and trying to address the critical infrastructure so that they can kind of do something about it before it's majorly exploited. Great.

Now, rail systems have often legacy operational technology, but they also have modern digital infrastructure. That needs to be considered, too. And there's a lot of complexity there. You know, where do you think organizations sometimes still underestimate cybersecurity challenges when it comes to securing these kinds of operational environments?

Well, one of the challenges with operational technologies is what are we trying to address which is different than what you typically try to address with IT systems.

So, you know, some of the approaches that we've used for IT with the rapid patching with some of the other approaches, those don't necessarily work well in operational technology. We're trying to deal with safety, we're trying to deal with uptime.

Those are the key factors that we're looking at. And so with those different outcomes, we have to have different approaches. And if we treat it the same, then we're not doing it justice.

So part of the problem is that each OT system is pretty much unique to the application for that organization. So what is it you're trying to do with it, how does it work in your environment?

And then you throw on top of that you have organizations that are trying to extract value out of those OT systems to get greater efficiency, to bring more visibility, those kinds of things create external connections that put that at risk.

And so with all of that, you've got to look at what are the outcomes that I'm driving for. Can I look at the full inventory and context of the systems that I have there, which are different than what I would see in it?

And then drive your architecture and your approach through that and you have to leverage what you can for from it. You bring over what works, but then you adapt some of it in order to reach the outcomes that you're trying to drive with ot.

So it is a little bit complex, but it is important that you treat it that way because if you just try to mingle it all, do it all the same, one size fits all, it doesn't work.

Now in sectors like logistics or transportation, the consequences of a security incident can be so much wider reaching than just simply data loss.

We've seen this play out with know, major headline events where a certain sector that is intricately involved with supply chain, you know, has had a ripple effect and has impacted the supply chain of certain things.

Does that change the way security leaders really need to look at cyber resilience in these particular types of sectors?

Well, I, I think again it goes back to, you know, what are the outcomes that we're driving for? And, and safety is a critical aspect to that. It's one of the most important things to us.

So when you look at it from that perspective, again, your risk appetite changes the way that you approach it in terms of the level of defense in depth, the compensating controls you have to put in place. It does change the way that you structure that.

So absolutely there's a different approach for it.

Now you're a seasoned cybersecurity veteran, but you have also worked across law enforcement as well as your experience in enterprise security.

So how do you think that background has helped to kind of shape your approach with managing cyber threats or particularly when dealing with adversaries that blur the line between criminal activity, espionage and state sponsored operations?

Well, it all comes back to risk, you know, and you're managing risk. You know, there's a strategy that you have to have and then there's the tactics that you have to address these things. And the strategy should be pretty similar across the way.

What are the things that are important to us? You know, how do we go about, you know, protecting those based on principal approaches? And then the tactics may change slightly depending on the various players. But you know, there's the hygiene has to be there.

You know, that's the, the foundation of everything is you've got to have the right hygiene, you know, and that means that you're looking at knowing what you have in place. You have to have a good cmdb, you have to have a limitation on your exposure.

So, you know, everything that's publicly facing, everything that you know is accessible broadly, those kinds of things, you've got to reduce that attack surface. You've got to look at what are we doing in terms of managing the vulnerabilities, how do we have our defense in depth set up?

All of those kinds of things are foundational to everything you do. And it really doesn't matter who the players are.

It's just the degree of what you put in place and the level of detective capabilities that you have in place and the ability to respond or all of those build in, but it's foundationally hygiene.

Now, we started the conversation where you mentioned geopolitical tensions and some of the different factors that are influencing that right now.

And so do you think that as geopolitical tensions kind of heat up, do you think that private industry is prepared for the reality that companies operating critical infrastructure are now effectively part of the front lines of national cyber defense?

Well, you know, private companies have been there for a long time. This is not a new situation. You know, you look at some of the attacks that were happening against Google, you know, decades ago, it's not something that's new.

You know, the nation state nexus actors have been focused on where they can exercise influence, where they can drive their desired outcomes. And it doesn't matter whether it's government or industry, they'll look for where it makes sense. And it's been a long time that they've been targeting industry.

It is new somewhat or more recent that they've been targeting some of the other components. But you think about it, when Ukraine was attacked it 10 years ago, they were attacking broad swaths.

I mean, that's how you had Maersk have the problems they had, you know, was because it was collateral damage from attacks that were based on industry. So, you know, it's not new. It's, it's more of a case of being more targeted. And, and you know, having to.

To understand that, you know, they have greater capacity to exert influence than they had before. So. Yeah, it's not new.

All right, well, Vaughn Hazen, thank you very much for joining us today.

Thank you for having me.

And thanks to you for watching. We will be doing more videos, so be sure to check them out from here at the CSO Cybersecurity Conference and awards. For now, I'm Joan Goodchild with CSO. We'll see you next time.