Reader Comment – Misinformation in OT

In response to my post yesterday about the upcoming meeting of the CISA Cybersecurity Advisory Committee (CSAC), Vytautas Butrimas left the following comment on LinkedIn:

“Reading one of the bullets – ‘Protecting Critical Infrastructure from Misinformation and Disinformation Subcommittee’ - one may wonder what their definition of critical infrastructure is. Any room for safety and process control issues or will the focus be on email, websites and social media?”

The short and quick answer to the question looks like the target of this Subcommittee will be information system misinformation. I say this based upon the report from the first meeting of the CSAC. The page 3 discussion about this Subcommittee reads thus:

“On the topic of Protecting Critical Infrastructure from Misinformation & Disinformation, Dr. Kate Starbird, University of Washington, noted that the level of disinformation being spread across information systems has been increasing dramatically in recent years. She noted that it was used in 2020 to undermine the U.S. election system and that it has also made it difficult for Governments to address crisis events like the COVID-19 pandemic. She said that the solution to addressing this is to teach people to care about whether what they're sharing is true or false. Mr. Chesney noted that it might be very difficult to get people to unlearn bad behavior like that as, after a while, it becomes an entrenched cognitive bias. He suggested that working with the various social media platforms to address the problem might be the best approach. Mr. Stamos and Ms. Allison noted that Government agencies are very bad at using their authority and platforms to push back against disinformation. Ms. Allison suggested that CISA create a playbook for agencies to use in responding to the spread of disinformation.”

Truthfully, none of the subcommittees would seem to be specifically directed at operational technology cybersecurity issues. The closest we get is the Building Resilience and Reducing Systemic Risk to Critical Infrastructure Subcommittee. The summary of the discussion about that Subcommittee area give us this statement:

“Mr. Fanning stated that one of the biggest impediments to industry and Government working together to address systemic risk is identifying the truly critical elements in critical infrastructure. He said CISA can help develop solutions, but that industry will need to take the lead in working with the Government to address the problem. Mr. Fanning noted that there are a number of models that CISA and industry could build on, such as the Analysis and Resilience Center for Systemic Risk developed by the Finance and Energy sectors. He closed by stating that, because industry controls the vast majority of critical infrastructure in the United States, the end goal should be for the Government to provide industry the tools to defend themselves.”

While the overall statement is ambiguous as to the scope of coverage of control system security issues, the final sentence is a good reminder that we are unlikely to see much in the way specific help on OT security issues.

Having said that, it is early in the life of the CSAC and perhaps we can still influence the direction they will take as they move forward. The best way to do that would be to actively participate in the considerations of the Committee. The easiest way to do this would be to begin sending proposals for the Subcommittees to consider, targeting the reducing systemic risk subcommittee. I will start that process by proposing two activities to be considered.

Proposing the formal establishment of the NCCIC-ICS as the office within CISA that is responsible for receiving, coordinating and publishing reports of control system vulnerabilities.

Proposing that the subcommittee start work on developing the regulatory structure for setting up the recently passed cyber incident reporting requirement.

I’ll have more discussion about these two potential ideas in future posts.