Why Critical Infrastructure Faces Cyberwarfare

TL;DR

Critical infrastructure is targeted because disrupting operational technology can advance geopolitical goals while keeping aggressors below the threshold of open conflict. Defenders should treat these attacks as demonstrated risks, recognize that operational technology exists in nearly every organization, and prepare for nation-state operations that can spread beyond their intended geographic target and cause extensive economic damage.

Transcript

Okay, so good morning, everyone. Um, happy to see everyone survived the parties of the week. I've got you-- I hope you've got some strong coffee, and I will try to keep this entertaining as we talk about economic warfare at eight thirty in the morning. So this is gonna be fun. Um, my name is, uh, Galina Antova, and for the last eight years, I have ... Read More

Key Insights

• Critical infrastructure is broader than utilities and manufacturing because operational technology also controls building systems, lights, elevators, and other functions that ordinary companies require for daily operations.
• Cyberattacks against civilian infrastructure are demonstrated threats, as operations targeting Ukraine's electric grid caused real disruption and included malware designed specifically to affect electrical systems.
• The Ukraine grid attacks functioned as a possible test of both technical capability and international reaction, revealing how adversaries could use cyber operations while avoiding the consequences associated with open conflict.
• NotPetya was a geopolitical cyber weapon that disrupted Ukrainian banking, transportation, and pension services while spreading internationally and causing more than ten billion dollars in losses.
• The danger of cyber warfare is its ability to cross geographic boundaries, affect organizations beyond the intended target, and create widespread economic damage without resembling a conventional military attack.
• Russia's cyber tactics operate below the threshold of open conflict, allowing the state to pursue strategic goals while retaining plausible deniability and avoiding the price normally associated with direct confrontation.
• Public attribution is a strategic response because naming the GRU and its associated operators connects separate incidents, reduces ambiguity, and begins establishing boundaries for unacceptable state behavior in cyberspace.
• Defending forward is a more proactive CYBERCOM strategy developed in response to foreign adversaries with near-peer offensive capabilities and greater freedom to conduct operations below the level of open conflict.

Questions & Answers

Q: Why is critical infrastructure targeted in cyber warfare?

Critical infrastructure is targeted because disrupting essential systems can weaken an opponent's economy, public services, and confidence without requiring an openly declared military conflict. Operational technology supports electricity, transportation, manufacturing, buildings, and other necessary functions. An adversary can therefore use cyberattacks to advance geopolitical goals while operating below the threshold that might provoke a conventional response.

Q: What systems are included in operational technology networks?

Operational technology includes more than industrial plants, electric utilities, and oil and gas facilities. It also includes building management systems, elevators, lighting, and other physical functions needed by ordinary organizations. This broad definition means that nearly every company has some operational technology exposure, even if it does not formally identify itself as part of a critical infrastructure industry.

Q: What did the cyberattacks on Ukraine's power grid demonstrate?

The attacks demonstrated that disrupting civilian electrical infrastructure through cyber operations is technically feasible and no longer hypothetical. They also may have tested how other countries would respond when a state used cyber capabilities in a way that crossed a boundary associated with open conflict. The limited international response was presented as a factor that encouraged further Russian activity.

Q: Why was NotPetya important to the development of cyber warfare?

NotPetya was important because it represented a powerful cyber weapon deployed in support of a geopolitical agenda. It severely disrupted Ukrainian services, including banking, transportation, and pension payments, while also affecting infrastructure around the world. The incident showed that state-sponsored malware can escape its intended area, disregard geographic boundaries, and impose extensive economic losses on unrelated organizations.

Q: How can cyber operations remain below the threshold of open conflict?

Cyber operations can create disruption, economic pressure, and political influence without using conventional military force. Attribution in cyberspace is rarely completely certain, so attackers can retain plausible deniability even when technical evidence and strategic outcomes indicate their involvement. This ambiguity allows a nation state to pursue hostile objectives while reducing the likelihood of paying the price associated with direct conflict.

Q: What was significant about publicly attributing the attacks to the GRU?

Public attribution was significant because the United States and United Kingdom connected several operations and named Russia's military foreign intelligence organization rather than referring only to Russia in general terms. The announcement linked attacks involving Ukraine, NotPetya, and Georgia. Naming responsible actors was presented as an initial effort to establish a boundary between accepted state behavior and unacceptable cyber aggression.

Q: How are attacks on infrastructure connected to attacks on democracy?

Infrastructure disruption and political interference can be understood as different methods for pursuing the same strategic objective. Attacks on energy or transportation can damage an economy, while interference with elections can weaken democratic institutions. The transcript presents these activities as related forms of pressure used by Russian state actors to continue geopolitical competition without entering an openly acknowledged conventional conflict.

Q: What does the defend forward strategy mean for cyber defense?

Defend forward reflects a more proactive CYBERCOM posture toward foreign nation-state operations. The strategy responds to adversaries that possess near-peer offensive capabilities and have greater latitude to act below the threshold of open conflict. Its central message is that persistent hostile activity cannot simply be tolerated, and that defense must address adversaries before their operations produce wider consequences.

Summary & Key Takeaways

• Operational technology includes industrial systems as well as everyday building functions such as lighting, elevators, and management systems. Because these systems support essential operations across many organizations, attacks against them can serve broader geopolitical objectives. The presented incidents demonstrate that disruption of civilian infrastructure is an established capability rather than a hypothetical concern.

• Attacks on Ukraine's power grid, followed by NotPetya, illustrate an escalating pattern of cyber operations attributed to Russian state actors. NotPetya disrupted banking, transportation, pension payments, and organizations beyond Ukraine. Its worldwide effects showed that a cyber weapon released for geopolitical purposes may ignore geographic boundaries and impose extensive economic costs elsewhere.

• Russia's approach demonstrates how states can pressure another country's economy and democracy without entering an openly declared conflict. Public attribution by the United States and United Kingdom sought to connect several operations to the GRU and establish boundaries for acceptable behavior. Defenders must interpret technical incidents within this wider geopolitical and strategic context.