Critical Infrastructure: Protection and Cybersecurity

Attacks on critical infrastructure are no longer movie scenarios. In 2021, a ransomware attack on Colonial Pipeline paralyzed fuel supplies on the US East Coast. In 2022, Russian cyberattacks accompanied the invasion of Ukraine, hitting power grids and telecommunications networks. Protection of critical infrastructure has become a national security priority for every country.

What is Critical Infrastructure?

Definition

Critical infrastructure refers to systems, assets, and networks that are essential for the functioning of society and the economy. Their disruption or destruction would have significant impact on national security, public health, safety, or economic stability.

Critical Infrastructure Sectors

Most countries identify similar critical sectors:

Sector	Examples	Key Systems
Energy	Power plants, transmission grids, pipelines	SCADA, DCS
Water	Treatment plants, distribution	ICS, SCADA
Transport	Airports, railways, ports	Traffic management
Banking	Payment systems, banks	Core banking, SWIFT
Healthcare	Hospitals, e-Health systems	Medical devices, EHR
Communications	Telecom networks, internet	Network infrastructure
Government	State registries, e-services	IT systems
Food	Strategic reserves, distribution	Supply chain
Emergency	Emergency services, 911	Dispatch systems
Chemical	Chemical plants, refineries	Process control
Defense	Defense industry	Classified systems

📚 Read the complete guide: NIS2: Kompletny przewodnik po dyrektywie NIS2 - obowiązki, kary, terminy

Cyber Threats to Critical Infrastructure

Attack Types

1. Nation-State Attacks (APT)

Advanced, persistent attacks sponsored by states:

• Russia - attacks on power grids (BlackEnergy, Industroyer)
• China - industrial espionage
• North Korea - financial attacks
• Iran - attacks on industrial infrastructure

2. Ransomware

The most costly threat to critical infrastructure:

Attack examples:
├── Colonial Pipeline (2021) - $4.4M ransom
├── JBS Foods (2021) - $11M
├── Kaseya (2021) - $70M demand
└── Costa Rica (2022) - government paralysis

3. OT/ICS System Attacks

Industrial systems (SCADA, PLC) are particularly vulnerable:

• Stuxnet (2010) - attack on Iranian centrifuges
• Triton/Trisis (2017) - attack on safety systems
• Industroyer (2016) - attack on Ukrainian power grid

4. Supply Chain Attacks

Software vendor compromise:

• SolarWinds (2020) - 18,000 organizations
• Kaseya (2021) - thousands of MSP firms

Attack Vectors

Vector	Frequency	Defense Difficulty
Phishing	Very high	Medium
VPN exploits	High	Medium
Unpatched systems	High	Low
Insider threat	Medium	High
Physical access	Low	Medium
Supply chain	Growing	Very high

Regulations and Legal Requirements

NIS2 Directive

NIS2 (Network and Information Security Directive 2) is the key EU regulation effective from 2024:

Scope:

• Essential entities - energy, transport, banking, health, water, digital infrastructure
• Important entities - postal, waste, food, manufacturing, digital services

Main Requirements:

1. Cybersecurity risk management
2. Incident handling (report within 24h)
3. Business continuity and crisis management
4. Supply chain security
5. Training and awareness
6. Cryptography and encryption
7. Access control and asset management

Sanctions:

• Essential entities: up to EUR 10M or 2% of annual turnover
• Important entities: up to EUR 7M or 1.4% of annual turnover

NIST Cybersecurity Framework

US standard widely adopted globally:

Core Functions:

1. Identify - asset management, risk assessment
2. Protect - access control, training, data security
3. Detect - monitoring, anomaly detection
4. Respond - incident response, communications
5. Recover - recovery planning, improvements

IEC 62443

Industrial automation and control system security standard:

• Risk assessment methodology
• Security levels (SL 1-4)
• Zone and conduit model
• Component requirements

Critical Infrastructure Security Architecture

Defense in Depth Model

┌─────────────────────────────────────────────┐
│           PHYSICAL LAYER                     │
│  Access control, monitoring, protection      │
├─────────────────────────────────────────────┤
│           NETWORK LAYER                      │
│  Segmentation, firewall, IDS/IPS             │
├─────────────────────────────────────────────┤
│           OT SYSTEMS LAYER                   │
│  SCADA/PLC hardening, OT monitoring          │
├─────────────────────────────────────────────┤
│           IT LAYER                           │
│  EDR, SIEM, vulnerability management         │
├─────────────────────────────────────────────┤
│           DATA LAYER                         │
│  Encryption, backup, DLP                     │
├─────────────────────────────────────────────┤
│           PEOPLE LAYER                       │
│  Training, awareness, procedures             │
└─────────────────────────────────────────────┘

IT/OT Segmentation

Key principle for industrial system protection:

Internet
    │
    ▼
┌─────────┐
│   DMZ   │  ← Buffer zones
└────┬────┘
     │
┌────▼────┐
│   IT    │  ← Corporate systems
└────┬────┘
     │
┌────▼────┐
│  OT DMZ │  ← Intermediate zone (Historian, Jump Server)
└────┬────┘
     │
┌────▼────┐
│   OT    │  ← SCADA, PLC, DCS (isolated)
└─────────┘

Purdue Model (IEC 62443)

Industry segmentation standard:

Level	Name	Systems
5	Enterprise	ERP, email, internet
4	Site Business	MES, Historian
3.5	DMZ	Firewall, Jump Server
3	Site Operations	SCADA Server
2	Area Control	HMI, Engineering WS
1	Basic Control	PLC, RTU, DCS
0	Process	Sensors, actuators

Protection Technologies

OT Network Security

Industrial Firewall:

• Fortinet FortiGate (OT Security)
• Palo Alto Networks (Industrial OT)
• Cisco Industrial Network Director

OT Traffic Monitoring:

• Nozomi Networks
• Claroty
• Dragos Platform
• Microsoft Defender for IoT

Anomaly Detection:

• Industrial protocol analysis (Modbus, DNP3, IEC 104)
• Device behavior baseline
• Unauthorized change detection

Security Operations Center (SOC)

Dedicated SOC recommended for critical infrastructure:

Capabilities:

• 24/7/365 monitoring
• IT and OT event correlation
• Threat intelligence
• Incident response
• Forensics

Tools:

• SIEM (Splunk, QRadar, Microsoft Sentinel)
• SOAR (response automation)
• TIP (Threat Intelligence Platform)

Vulnerability Management

OT environment specifics:

• Long lifecycle - systems operate 15-20 years
• No patching capability - production continuity
• Legacy systems - Windows XP, outdated firmware

Solutions:

1. Virtual patching (IPS/WAF)
2. Micro-segmentation
3. System hardening
4. Compensating controls

Incident Management

Incident Response Plan

Incident handling phases:

1. Preparation

   • Response team (IRT)
   • Procedures and playbooks
   • Tools and access
   • Contacts (CSIRT, police, regulator)

2. Identification

   • Monitoring and alerting
   • Incident triage
   • Severity classification

3. Containment

   • System isolation
   • Evidence preservation
   • Crisis communication

4. Eradication

   • Threat removal
   • Root cause analysis
   • Vulnerability patching

5. Recovery

   • System restoration
   • Security verification
   • Enhanced monitoring

6. Lessons Learned

   • Post-mortem report
   • Procedure updates
   • Lessons learned

Reporting Requirements (NIS2)

Timeline	Requirement
24 hours	Initial incident notification
72 hours	Update with severity assessment
1 month	Final report with conclusions

Business Continuity and Resilience

Business Continuity Planning (BCP)

Plan elements:

1. Business Impact Analysis (BIA)
2. Recovery Time Objective (RTO)
3. Recovery Point Objective (RPO)
4. Failover procedures
5. Crisis communication plans

Disaster Recovery

Backup strategies for OT:

• PLC/SCADA configuration copies
• HMI system images
• Offline technical documentation
• Critical spare parts

Testing:

• Regular recovery tests
• Tabletop exercises
• Cyberattack simulations

System Resilience

Designing with failures in mind:

• Critical component redundancy
• Automatic failover
• Graceful degradation
• Manual override capability

Best Practices for Critical Infrastructure Operators

Organizational Recommendations

1. Governance - dedicated CISO, board reporting
2. Risk Management - regular OT risk assessment
3. Compliance - NIS2, sector regulations
4. Audits - external security audits
5. Insurance - cyber insurance policy

Technical Recommendations

1. Segmentation - IT/OT isolation, micro-segmentation
2. Monitoring - full OT traffic visibility
3. Hardening - attack surface minimization
4. Patching - regular IT, virtual patching OT
5. Backup - 3-2-1 rule, recovery tests
6. Encryption - data at rest and in transit

People Recommendations

1. Training - regular, role-appropriate
2. Awareness - phishing simulations
3. Procedures - clear and current
4. Exercises - regular plan tests

Future of Critical Infrastructure Security

Trends and Challenges

IT/OT Convergence:

• Growing system integration
• Industry 4.0 and IIoT
• Edge computing in OT

New Threats:

• AI in attacks
• Quantum computing
• 5G and new vectors

Regulations:

• NIS2 and future amendments
• Cyber Resilience Act
• Standardization (IEC 62443)

Role of AI and Automation

• OT traffic anomaly detection
• Automated incident response
• Predictive security maintenance
• AI-assisted threat hunting

Summary

Critical infrastructure protection is not just a legal requirement but a fundamental task for national security. In an era of growing cyber threats, operators must:

• Treat cybersecurity as a strategic priority
• Invest in people, processes, and technologies
• Cooperate with government agencies and private sector
• Prepare for incidents, not just prevent them

NIS2 implementation and continuous security improvement is a process, not a one-time project. Only a holistic approach to security will effectively protect systems on which the functioning of state and society depends.

---

Need support in securing critical infrastructure? Contact us - we’ll help with risk assessment, security implementation, and NIS2 compliance.

Related Terms

Learn key terms related to this article in our cybersecurity glossary:

• NIS2 — NIS2 (Network and Information Security Directive 2) is an EU directive…
• Cybersecurity — Cybersecurity is a collection of techniques, processes, and practices used to…
• Cybersecurity Incident Management — Cybersecurity incident management is the process of identifying, analyzing,…
• NIST Cybersecurity Framework — NIST Cybersecurity Framework (NIST CSF) is a set of standards and best…
• IT Security Architecture — IT security architecture is a structural approach to designing, implementing,…

---

Learn More

Explore related articles in our knowledge base:

• A security operations center (SOC) in every office? We demystify a key requirement of the KRI and NIS2
• Common Misconceptions About the NIS2 Directive
• How is KSC NIS2 revolutionizing procurement processes? A Guide for the Head of Procurement
• How to conduct a KSC NIS2 readiness audit? A practical guide for CISOs
• IEC 62443: A practical guide to zones, ducts and safety levels for your factory

---

Explore Our Services

Need cybersecurity support? Check out:

• Security Audits - comprehensive security assessment
• Penetration Testing - identify vulnerabilities in your infrastructure
• SOC as a Service - 24/7 security monitoring