Historically, Industrial Control Systems (ICS) could exist as a closed-loop, with an air-gapped network and a solid physical security program insulating them from the outside world. An operator could trust the integrity of their operations based on process outputs, and when processes broke down maintenance was brought in to locate and fix the issue.

In the past decade, we have seen an alarming increase in attacks on critical energy infrastructure, with cyber incidents occurring across any number of geographies and industries. Common attacks can involve ransomware on a corporation’s Information Technology (IT) network that controls business operations, or a direct attack on a corporation’s Operational Technology (OT) systems that control industrial infrastructure.

If carried out as described, the actions proposed in the American Jobs Plan will help to bolster the cybersecurity posture of American critical infrastructure, however they do not go far enough to address the vast scale and scope of the problem we are facing.

As far as legacy Industrial Control Systems (ICS) are concerned, level 0/1 serial communications monitoring isn’t just about network security; it’s also about utilizing the data as a “first step” to digital transformation.

To anyone working in cybersecurity, it is not news that just about every critical infrastructure industry is significantly behind on their path toward cybersecurity maturity. There continues to be a fundamental friction between the estimation of cyber risk and the short-term thinking of today’s quarterly budgetary decisions.