By Gregory Hale
Hundreds of millions of citizens across the world watch in horror January 6 as the United States’ Capitol suffered a brutal attack not only in a physical manner, but also on the nation’s very soul.
Make no mistake about it, whether you were pro-Biden or anti-Biden, pro-Trump or anti-Trump, all – I repeat – all governing bodies and courts across the country agreed on who won the Nov. 3 election to be the next President of the United States.
Yes, the President has the right to contest the vote, and yes, he has a right to speak out against about what he feels is wrong, but inciting an insurrection against the government he swore to defend and protect obviously takes things to a level of sedition or potentially even treason.
Like a boxer suffering a knock down in the early rounds, the country’s democracy quickly got back up and continues to fight – and win – against all attackers.
Attack Methods
Now, however, starts the game of politics. Whether it is Speaker Nancy Pelosi or Rep. Alexandria Ocasio-Cortez (AOC) on the Democrats side or Rep. Jim Jordan and Senators Josh Hawley and Ted Cruz on the Republican side, blatant partisan politics just fans the flames for future domestic terrorist attacks on the country.
Instead of focusing on healing, those petty and appalling politics continue to play out in the name of standing up for democracy. What also comes to mind is often times attackers don’t share the same attack method more than once. To that end, all three aspects of this publication continue to stand at the fore: Safety, cyber and physical security.
The images of rioters breaking down barricades, smashing windows and scaling walls brought to mind if attackers wanted to get into a critical infrastructure facility with that kind of commitment and force, could they be stopped? Keep in mind professional police officers at a well-armed Capitol police force were not able to provide much resistance.
Along those lines, a cyber assault could be the attack vector that can lead to a safety or physical security breach.
Safety Connections
Think about it, more safety devices and overall technology have some type of connection to the control network and as tight as the security may be around that connection or those connections, there is a potential for an attacker to exploit that connection to take over the system. A perfect case in point would be the attack on a Saudi Arabian refinery where attackers got in and took control of the safety system and the distributed control system. Attackers were only caught because they made a mistake which tripped the safety system which then shut down the facility.
Same can be said on the physical security end. With more physical security devices falling in the digital environment, with technology like IP-based cameras, Bluetooth-enabled locks, Internet-connected doors and fences to name a few, a quick attack over a weak physical security system could just open the door for attackers.
That leads into the discussion about a stronger cybersecurity program.
These domestic terrorists are no dummies, they know their way around computers, networks, and the Internet. It can’t be a surprise to anyone they have done their reconnaissance. Will the inauguration be the next target, or will it be something else to make a statement? Only time will tell, but in the meantime, security and safety professionals need to step up their game and understand right now everyone and everything is a target.
Manufacturing automation professionals, whether they are executives, operators, engineers, safety or security practitioners, need to remain focused on keeping facilities safe and secure.
Questions Need Answering
Do manufacturers have the correct competence in place? Do they understand what can go wrong? An attempt to take over the Capitol seems far-fetched, but is anything off the table now? Can manufacturers treat deficiencies in an effective manner? Do manufacturers even know what they have so they can protect it?
Obviously, the answers only lie within an individual company, but it would be safe to say most companies cannot satisfactorily answer all of those questions. Government officials never thought the Capitol would be attacked; they thought they had the answers. They were wrong.
Political attacks are real. And they just don’t hit government buildings, but rather real-time critical infrastructure targets. Just look at Iran’s nuclear facilities, Ukraine’s power utilities twice, even U.S. utilities to name a few.
Forget who the potential attacker could be. The discussion should really concentrate on how prepared manufacturers are. What is really coming into play here is there continues to be an increasingly sophisticated level of threats against manufacturers and their control systems. What we really don’t know – and only individual companies can answer – is how prepared are they to fight off any kind of attack, be it cyber or physical?
If a manufacturer’s security plan is mature enough to include incident response and disaster recovery, then it will be able to respond quickly. If the company does not have a plan, or a weak one, then it is rolling the dice.
Get smart and stay safe and secure.
Sid, Thanks for sending in your note…. I couldn’t agree with you more…
Jeffrey Smith, thanks for sending in your note… I will say, this was an opinion piece that appeared in two sections of the ISSSource website… The news section and the Viewpoint section…
While I’m not particularly following this fiasco in the Capital and don’t have enough information to derive an opinion one way or the other about what went down in the Capital, other than it never should have, I think this comment
“but inciting an insurrection against the government he swore to defend and protect obviously takes things to a level of sedition or potentially even treason.”
would be contested by many, and it’s not objective, it pointedly makes a statement as to opinion, not unbiased recognition of the event. I suspect there are a few who would consider this inflammatory. Let the courts decide who did right or wrong based upon the facts, not hearsay, media reporting, or the court of personal opinion.
Good article Greg! I like the analogy you make between industrial issues and the attack on the US Capital.
Building on the point about the Capital Police being overwhelmed, I would suggest that plants face a similar situation – inadequate resources to deal with a serious, well-planned cyber attack. The national guard should have been ready to assist and companies need to make sure that they have well-established plans and capabilities that can rapidly engage a sophisticated team of cyber defenders as soon as suspicious activity is detected. The need for converging IT and OT cybersecurity programs has never been more apparent and urgent.