Critical infrastructure is the name given to the hardware, software, networks, and systems that allow humans to live their lives. Critical infrastructure categories include defense, healthcare, and government facilities. Unfortunately, in recent years, critical infrastructure has become a target for malicious cyber actors from nation-states, including China, Russia, Iran, and North Korea. Numerous examples exist of successful and unsuccessful attempts by these nation-states to breach critical cyber defenses, some with devastating consequences.
The need to protect critical infrastructure is clear. If these networks went down due to a cyber attack, it could compromise national security, cause power cuts, or even lead to unnecessary deaths. It’s no wonder hostile nations attempt to infiltrate critical infrastructure, and why governments and organizations invest in Critical Infrastructure Protection (CIP).
CIP harnesses threat intelligence technology to help nations face these more complex and constantly evolving cyber threats. The key is rapid threat detection, so organizations can head off potential attackers before they can do any significant damage. In this article, we’ll tell you more about it and show how deception technology takes threat intelligence to the next level.
How Do We Protect and Manage Risks to Critical Infrastructure?
Knowledge is power. The more you know about your critical infrastructure, who is using it, and how they interact, the easier it is to spot if something potentially malicious is happening. Furthermore, the more you know about would-be cyber attackers and their methods, the faster you can neutralize them and protect your critical infrastructure.
This is where threat intelligence comes in. Threat intelligence is more than traditional, reactive cybersecurity, which is when you respond to a threat as it happens. Instead, it’s a proactive approach where organizations take the fight to the attackers, gather contextual and actionable insights, and use them as part of a network protection strategy. Innovative technological developments, such as deception, allow for a more confident approach to fend off cyber adversaries, even those powered by hostile nation-states.
Threat intelligence is more than traditional, reactive cybersecurity, it’s a proactive approach where organizations take the fight to the attackers, gather contextual and actionable insights, and use them as part of a network protection strategy.
Evaluating the Need for Threat Intelligence in Critical Infrastructure
Make no mistake: critical infrastructure is a tempting target for cyber attackers. The consequences of a successful attack could bring down an entire nation. It’s also possible to collect a vast amount of personal data on citizens that could be used in subsequent attacks and scams. Many notable examples of critical infrastructure attacks highlight the need for effective threat intelligence. These include:
- Switzerland – In May 2023, a cyber breach led to the theft of 65,000 documents from Switzerland’s police and judiciary systems. These documents contained sensitive personal data including passwords, which could be used in future cyber attacks1.
- Iran – In December 2023, hackers linked to Israel took down 70% of Iran’s gas stations in an attack on their payment systems2.
- India – In March 2024, a cyber attack campaign infiltrated systems in India’s government and energy sectors. The cause was a malware-infected file disguised as a letter from the Indian Air Force3.
How is Threat Intelligence Used in Critical Infrastructure?
While previous critical infrastructure attacks were devastating, they did serve as a wake-up call. Governments and organizations, having seen the consequences, did not want to be the next victim, and they invested time, money, and resources into infrastructure security to make sure of it. There are now several examples where threat intelligence has helped governments and organizations thwart attacks on their critical infrastructure.
For example, in February 2024, the FBI reported it had neutralized a series of cyber attacks from a group called Volt Typhoon, sponsored by the Chinese state. Volt Typhoon was targeting critical infrastructure in the US, including the power grid and gas pipelines, and had infiltrated many US assets via vulnerabilities in old office routers. However, thanks to threat intelligence gathered by Microsoft, US security experts were able to shut down Volt Typhoon’s activities.
Integration of Cyber Threat Intelligence
By incorporating threat intelligence into your overarching cybersecurity strategy, you turn your approach from reactive to proactive and maximize your chances of rapid threat detection.
Here are four steps to effectively integrate threat intelligence into your cybersecurity strategy:
- Collect – Set up your threat intelligence tool to collect and prioritize threat data.
- Share – Leverage data from other organizations (such as fellow government bodies) to understand the specific threats they’re dealing with at any given time. Share and collaborate to stand up to cyber attackers together.
- Detect – Set criteria for what constitutes a threat, so you can stay on alert without creating notification fatigue.
- Respond—Develop a plan for responding to specific threats so you can neutralize them before they cause significant damage.
The fewer steps you can have between detecting a threat, analyzing it, and taking action, the better.
Threat Intelligence In SOC
Threat intelligence should be a vital function in your Security Operations Center (SOC) in order to keep your critical infrastructure as secure as possible. When you leverage unified threat intelligence to inform, direct, and provide context, you immediately fortify your security operations and cyber risk programs.
For example, critical infrastructure organizations should utilize strategic threat intelligence to inform cybersecurity strategy, such as where to focus enhancements to security controls that improve defenses. After all, the better you know your adversaries, their methods, and their activities at that moment, the better you can allocate resources.
SOC teams in critical infrastructure organizations have to deal with tremendous pressure. It’s no exaggeration to say that the survival of the organization – and perhaps even the nation itself – depends on them carrying out their roles successfully. One of the most complex parts of the role is prioritizing, figuring out which of the multiple threats should be dealt with first and how. This is where a good threat intelligence tool proves its worth, automating time-consuming tasks while delivering real-time data to point SOC professionals in the right direction.
Threat Intelligence Powered By Deception. What is It?
Advanced deception technology platforms have revolutionized threat intelligence by allowing organizations to collect specific, actionable threat intelligence in real time. Quite simply, deception allows you to beat cyber attackers at their own game.
Here’s how advanced deception technology works:
- Deception technology can be used to create a parallel, digital twin network identical to your existing one.
- When attackers turn their attention to your organization, they are lured into the digital twin rather than your real system.
- They carry out malicious activities, thinking they’re inside your network. However, because they’re in the deception environment, there’s no impact on your infrastructure.
- While the attackers are in the environment, advanced deception technology monitors their every move, gathering data on their methods.
- You can now outsmart attackers every time, protecting your critical infrastructure and gathering valuable threat intelligence for the future,
The threat intelligence that advanced deception delivers is the key to its effectiveness. In the deception environment, you gain real-time information and data on who the malicious actors are and the methods they use inside your network. When security professionals get an alert from their threat intelligence powered by deception solution, they can be sure that it’s an immediate priority, specific and actionable, delivered before the attackers have found a way into the actual network. By addressing the most critical areas first, you’re more likely to neutralize any attack.
This approach helps you make more informed, data-driven decisions on the best ways to strengthen your defenses in the future. Only threat intelligence powered by deception can deliver specific, actionable insight with this amount of value.
The beauty of deception is that it takes the fight to the cyber attackers. With deception technology, you’re not sitting there waiting for an attack; you’re gathering valuable data on them, which will better protect you in the future. What’s more, it all happens without any impact on your critical infrastructure network.
Real Life Examples with REE and Ukraine
Threat intelligence powered by deception sounds excellent in theory, but can it work in practice? For threat intelligence to provide optimal protection, it is critical to detect any threats fast, so that essential data and systems are protected before any attack is carried out.
Do sophisticated, nation-state-affiliated cyber attackers fall for threat intelligence powered by deception and share their secrets in a harmless, digital twin environment? Do they really deliver specific, actionable threat intelligence to the very people they’re trying to harm?
The answer is yes – and we have two examples to prove it.
Red Electrica de Espana (REE) is Spain’s national electricity grid. Concerned that their legacy operational technology (OT) systems could be the target for cyber attackers, with potentially devastating consequences, REE worked with CounterCraft to deploy deception technology.
Only a few weeks after implementation, CounterCraft The Platform detected threat actors in its digital twin environment. They were attempting to exploit a critical vulnerability to gain control of an electrical substation. Over the course of six hours, The Platform delivered real-time intelligence on their activities. Now, REE’s security experts knew precisely how the attacker conducted reconnaissance during their discovery and exploitation phase before a breach could occur. When the attackers eventually turned their attention to real parts of the network, it was easier to identify and neutralize them.
The threat intelligence delivered by CounterCraft’s Platform was specific and detailed, alerting REE’s security professionals before the attackers could infiltrate the real network. They could take immediate action to safeguard the genuine critical infrastructure, knowing exactly where the priority areas were. This is because of the effectiveness of threat intelligence powered by deception.
You can find out more about REE’s battle with cyber attackers in this case study from CounterCraft.
In 2022, just weeks before Russia’s full-scale invasion of Ukraine, Russian hackers entered one of CounterCraft’s deception environments, attempting to use one of our deception hosts to attack Ukrainian infrastructure.
Their plan was to run commands as privileged users and attack a Ukrainian government web page. However, when they tried to run the CVE-2021-4034 vulnerability that would enable them to access privileged user status, they discovered the host was not vulnerable to it. They then tried to delete their evidence by sending an empty character to the log files and deleting their previous scripts.
During their stay in CounterCraft’s deception environment, the attackers also launched a Bash command to create one billion empty files, which they later deleted. As a final insult, they left a Bash loop running a curl command once per second against the Ukrainian government’s web page.
Of course, as they were working in a deception environment rather than the webpage’s actual back end, the attackers couldn’t do any serious damage. However, their methods signaled what Russia might do in the future. Days later, on February 15, 2022, Russia launched a genuine DDoS attack on Ukrainian digital infrastructure as part of their full-scale invasion.
In both these examples, threat intelligence powered by deception provided intel that was key to preventingsome serious consequences, including loss of power supply and damage to national security. To safeguard critical infrastructure with rapid threat detection, actionable insights, and network protection, deception should be an essential part of your security stack.
Why CounterCraft?
CounterCraft The PlatformTM is trusted by CISOs of leading global organizations to protect their critical infrastructure with threat intelligence powered by deception.
The Platform takes you beyond detection and monitoring to deliver a solution that detects threats faster, beats cyber attackers at their own game, and provides specific, actionable threat intelligence to protect your critical infrastructure in the future.
The Platform enables you to easily:
- Design and build deception environments
- Automate and deploy campaigns
- Manage and monitor incidents as they happen
- Divert adversaries away from your critical systems
- Get the big picture of your infrastructure security on one simple dashboard
CounterCraft is the choice for governments and nation-states. In 2021, Gartner recognized CounterCraft as a Cool Vendor in Cyber Physical Systems Security. Its value is demonstrated daily in national security and defense, finance, energy, healthcare, and beyond.
The Role of CISA
CounterCraft was chosen as an approved supplier by CISA.
The Cybersecurity & Infrastructure Security Agency (CISA) is the US’s agency focused on cybersecurity and defending critical infrastructure against hostile threats. Its goal is to build more secure and resilient critical infrastructure systems for a safer future.
CISA’s endorsement recognizes CounterCraft as a global threat intelligence leader with solutions that, quite simply, make the world safer. Today, CounterCraft is the threat intelligence partner of choice for some of the world’s most sophisticated organizations, from governments to critical infrastructure to Fortune 500 companies.
Conclusion
For CISOs tasked with safeguarding critical infrastructure, threat intelligence powered by deception should be part of your cybersecurity strategy.
If it hasn’t happened already, you will be targeted by sophisticated cyber attackers one day. When that attack comes, rapid threat detection is essential. Deception is the most effective way to identify an attack quickly, divert it away from your critical systems, and gather intelligence to neutralize those attackers in the future.
Be prepared when the inevitable cyber attacker targets your organization, and keep your critical infrastructure systems running smoothly.
Sources:
1 https://www.infosecurity-magazine.com/news/ransomware-leak-swiss-government/