What Is Critical Infrastructure Protection (CIP)?

Critical Infrastructure Protection (CIP) is the need to protect a region's vital infrastructures such as food and agriculture or transportation. Every government in every nation has a responsibility to protect these essential critical infrastructure against natural disasters, terrorist activities and now cyber threats. From energy organizations to transportation companies, it is paramount that security in all critical infrastructure sectors is of the highest standard and that disaster preparedness, response and recovery are top priorities. Common components of critical infrastructure needing security considerations include Industrial Control Systems (ICS), Operation Technology (OT), and SCADA Systems.

The world is changing, and digital and physical systems are converging. Systems that once stood alone managing critical infrastructure operations are connecting to the internet and sharing sensitive data. This new world structure brings with it new security problems. Critical infrastructure organizations must use a robust framework that can anticipate and mitigate disaster across their entire critical infrastructure environment. Critical Infrastructure Protection (CIP) helps organizations to prepare for and respond to serious incidents involving critical infrastructure environments and to protect against an ever-growing number of threats.

In May 1998, presidential directive PDD-63 was issued by Bill Clinton. The directive documented areas of national infrastructure that were deemed critical to the national and economic security of the United States and the steps that were required to protect these areas.

In total, 16 major sectors were identified as critical infrastructure, and each government department and agency was made responsible for formulating a CIP plan to protect each area. These agency plans were combined to create one comprehensive plan, known as the National Infrastructure Assurance Plan. In 2006, the National Infrastructure Protection Plan (NIPP) was formulated and outlines how government and private sector parties can work together to manage risks and resilience and security outcomes.

At the time of writing, 16 sectors were officially listed as critical infrastructure sectors. However, election systems have recently been designated as critical infrastructure by the Department of Homeland Security.

The 16 critical infrastructure sectors include:

• Chemical Sector
• Commercial Facilities Sector
• Communications Sector
• Critical Manufacturing Sector
• Dams Sector
• Defense Industrial Base Sector
• Emergency Services Sector
• Energy Sector
• Financial Services Sector
• Food and Agriculture Sector
• Government Facilities Sector
• Healthcare and Public Health Sector
• Information Technology Sector
• Nuclear Reactors, Materials and Waste Sector
• Transportation Systems Sector
• Water and Wastewater Systems Sector

America's access to electricity, transportation networks, drinking water and many other critical infrastructure services is increasingly at risk from cyber-attacks. These threats can have devastating consequences and could threaten global economies and entire communities. The success of critical infrastructure protection initiatives relies on strong and meaningful partnerships being built between governments and commercial parties. Success also relies on the solutions that are used to manage and implement these initiatives.

It is also important to recognize the risks that could threaten the integrity of critical infrastructure systems. When we think about system or network security, we almost always immediately think of hacker or terrorist threats, but there are other threats that should also be taken into account, such as equipment failure, human error and natural causes (the weather, for example). When selecting solutions that detect and identify security risks and anomalies in expected behavior, it is important to factor in as many of these risks as possible.

Protecting the country's most critical services is no easy task. It requires continued collaboration and cooperation between key agencies and departments and the continuous application of improved CIP technologies and processes.

The ability to detect changes in network traffic in real-time, apply granular security policies and respond to incidents in minutes is just one of the features offered by Forcepoint's Next Generation Firewall (NGFW). As critical industrial systems evolve and become more connected, it is reassuring to know that you have a fast, flexible and sure solution available that combats the new threats your systems are exposed to and protects the integrity of your critical operations.