What is the National Infrastructure Protection Plan (NIPP)?

The National Infrastructure Protection Plan (NIPP) was developed by the U.S. Department of Homeland Security to manage risk, resilience and security in critical infrastructures across a number of sectors. The plan outlines how government departments and private sector parties can integrate and collaborate to manage risk. The well-being of the nation relies heavily on a resilient and secure critical infrastructure being in place. From drinking water to transportation and energy to financial systems, these are the services that underpin society as we know it, and they must be protected at all costs.

The risk environment that affects critical infrastructure networks is uncertain and complex; there has been a significant evolution of vulnerabilities, threats and consequences over the past decade. Critical infrastructure has long been threatened by risks such as natural disaster and physical threats, but it is only recently that cyber risks have been thrown into the mix.

The initial version of NIPP was published in 2006 and revised in 2009 and 2013. These revisions were largely made to address the evolution of industrial control systems (ICS) and operational technology (OT). New technology has introduced vulnerabilities that must be addressed in OT. For example, a SCADA System looking to improve interoperability by adopting IoT will become open to a whole new world of possible attacks. The plan is focused at a wide-ranging critical infrastructure community made up of both private and public critical infrastructure operators and owners.

The NIPP addresses a number of key areas and responsibilities, including:

• Identify, deter, detect, disrupt and prepare for threats and hazards to the nation's critical infrastructure.
• Reduce vulnerabilities of critical systems, assets and networks.
• Mitigate the potential consequences to critical infrastructure of adverse events and incidents that do occur.

The National Plan segments critical infrastructure into 16 sectors. Each sector has a federal agency or department

A common mission and vision are necessary to ensure the success of the National Plan. These stand as follows:

Vision

A nation in which physical and cyber critical infrastructure remain secure and resilient, with vulnerabilities reduced, consequences minimized, threats identified and disrupted, and response and recovery hastened.

Mission

Strengthen the security and resilience of the nation's critical infrastructure by managing physical and cyber risks through the collaborative and integrated efforts of the critical infrastructure community.

Goals

Analyze and assess threats to, consequences to and vulnerabilities of critical infrastructure to inform risk management activities.

Secure critical infrastructure networks against physical, cyber and human threats through sustainable efforts to reduce risk while accounting for the benefits and costs of security investments.

Enhance critical infrastructure resilience by minimizing the adverse consequences of incidents through advance planning and mitigation efforts and employing effective responses to save lives and ensure the rapid recovery of essential services.

Share actionable and relevant information across the critical infrastructure community to build awareness and enable risk-informed decision-making.

Promote learning and adaptation during and after incidents and exercises.

If the bad guys know where the vulnerabilities are, you can guarantee that your systems will be compromised at some point. Vulnerabilities differ by sector and what is believed to be critical infrastructure will also be defined by the sector it serves. For example, in the financial industry, that critical infrastructure may include online banking operations or credit card systems. In the energy sector, that critical infrastructure may include an electricity grid delivering energy across an entire city.

As with any type of network, if the bad guys know where the vulnerabilities are in a critical infrastructure environment, it's not a matter of if you are attacked but when. These threats can come from a number of angles: attacks to legacy systems that are no longer supported and therefore cannot be patched, attacks to systems that are connected to the internet, and phishing attacks that rely on human interaction.

Fortunately, despite the growing number of vulnerabilities and challenges, so far the nation's critical infrastructure has managed to escape a major attack. This is down to a combination of solutions; NIPP partnerships that ensure each organization is responsible for its own sector and agile security solutions that monitor and detect attempts to compromise critical infrastructure security.

Forcepoint's Next Generation Firewall (NGFW) offers industry-leading security that protects critical infrastructure assets. Designed from the ground up for high scalability and availability, NGFW keeps pace with changing security needs and puts you in control.