Cybersecurity Preparedness
in Critical Infrastructures(CIs)
IC-AJCC 2023

Kenji Watanabe
Professor of Graduate School of Social Engineering
Head of Disaster and Safety Management(Japan)
1AgendaAGENDA

1. Scope of Critical Infrastructures(CIs) and important factors to be discussed
2. Case Study: Cyber-Physical Security for Seaport Operations
3. Important aspects to be discussed for Cyber-Physical Security for CIs
Next Steps and Challenges

2

Agenda1. Scope of Critical Infrastructures(CIs) and important factors to be discussed3

Scope of Critical Infrastructures (CIs) in Japan [1/2]

AgendaDefinition of critical infrastructure varies slightly from country to country: “Autonomic” approachn 14 CIs are defined by the Cybersecurity Basic Act
n NISC is monitoring CI operations to define safety
standards and to coordinate cross-sector exercises.
n Actual coordination with CIs is governed by each
responsible ministry or agency.

Scope of Critical Infrastructures (CIs) in Japan [2/2]

AgendaDefinition of critical infrastructure varies slightly from country to country: “Autonomic” approachn 4 ministries and 1 agency govern
14 CIsFinancial Services Agency
Ministry of Economy, Trade, and Industry
Ministry of Health, Labor, and Welfare
Ministry of Land, Infrastructure, and Tourism
Ministry of Internal Affairs and Communicationn Over half of CIs have ISAC
(Information Sharing and Analysis
Center) but some of them have
responsible governmentʼsinvolvement.
n Some ISACs such as Financial
ISAC are internationallyconnected.

Scope of Critical Infrastructures (CIs) in US [1/2]

AgendaDefinition of critical infrastructure varies slightly from country to country: Cross-sector approach*DHS: Department of Homeland Security, **CISA: Cybersecurity and Infrastructure Security Agency

n Systems or assets, whether physical or virtual, that are
critically important to the United Statesn An impact that, if unavailable or destroyed, would
undermine security, national economic security, or
national public health or safety.
n First defined in PDD***-63 during the Clinton
administration in 1998 and subsequently revised.
n Cross-departmental related organizations include CISA
(Cybersecurity & Infrastructure Security Agency) andDHS (Department of Homeland Security).
n Differences from Japan: Dams, emergency services,
government facilities, IT, commercial facilities, core
manufacturing, military industry, food and agriculture,sanitation, sewage***PDD: Presidential Decision Directive6

Scope of Critical Infrastructures (CIs) in US [2/2]
CISA is working with the corresponding sector-specific agencies in cybersecurity

7

Scope of Critical Infrastructures (CIs) in UK

AgendaDefinition of critical infrastructure varies slightly from country to country: UK(CPNI*)*CPNI: Centre for the Protection of National InfrastructureImportant factors to be discussed: Itʼs obvious but things to be reminded [1/3]

AgendaInterdependencies, Interoperability, and Cyber-Physical Integrated ResponsesHRequiredInteroperability

Required Level ofCyber-Physical Responses

HLInterdependency
among CIsH

L CI Operations Dependency Hon ICTs

n Rapidly increasing interdependencies among CIs require well-coordinated interoperability among CI
operators and responsible governmental agencies in the incident responses (cyber and physical incidents)
n Emerging dependencies on ICTs of CI operations caused more physical failure consequences triggeredby cyber incidents which requires Cyber-Physical integrated responses.
9Important factors to be discussed: Itʼs obvious but things to be reminded [2/3]

AgendaThere are some “hub” of interdependencies among CIs and highly possibility cause failure consequences
n The electricity sector is in a position to demand a more resilient cybersecurity system because the social
and business impacts of service outages and functional degradation in the sector would besignificant. (Many of other CIs have heavy dependency on the electricity sector)
n Any disruptions in the sector will cause chain failures in the sector of Telecom, Finance, Railways,
Healthcare, Broadcast, and Governmental Services.
n This makes it an ideal target for cyberattacks that could cause social disorder and all related CIs haveto build interoperability in the incident responses with responsible governmental agencies.

10Important factors to be discussed: Itʼs obvious but things to be reminded [3/3]

AgendaEmerging dependencies on ICTs of CI operations cause more physical failure consequences
n Emerging dependencies on ICTs of CI operations caused more physical failure consequences triggeredby cyber incidents which requires Cyber-Physical integrated responses.
n This accelerates failure spreads among CIs through interdependencies.
n METI (Ministry of Economy, Trade, and Industry of Japan) has developed a framework to mange thesituation. (CPSF: Cyber Physical Security Framework)
n CPSF is currently being standardized internationally based on a Japanese proposal, and addressing
supply chain risks, among others.

11
CPSF Framework developed by the Japanese Government (METI)

Agenda2. Case Study: Cyber-Physical Security for Seaport Operations

12

Cyber-Physical Incident in Seaport Operation (July 4,2023: Nagoya, Japan)
Cyber-triggered physical incident and the importance of establishing communication lines with local policen The Nagoya Port, one of the largest container handling port, had beenclosed for two and half days by cyberattack with ransomware.
n Approximately 20 thousands containers could not be handled.
n The operator recovered the system from the back-up data.
n Aichi Prefectural Police contributed to the early recovery.
July 4, 2023
0630: Container handling system shutdown
0730: A large number of threatening texts were printed from printers
0900: Notify the Cyber Attack Response Team at the Aichi Prefectural Police
1400: Verify all encryption of physical and virtual servers
1800: Discussed response with Aichi Prefectural Police（ Virus removal of backup data, network failure response, etc. ）July 6, 2023
1415: System recovered and backup data and yard inventory consistency
checked.
1500: Operation resumed sequentially from Tobishima Pier South Terminal

Consideration for more severe cyber-triggered physical incidents
Many stakeholders in private/public sectors make the situation difficult in response to the severe incidents

n Largest manufacturing and import/export operationsof TOYOTA locate in the Nagoya area.
n Critical suppliers for global supply chains also locate.
n Too many large stakeholders are factors of challenges
for coordinationn 4 cities and 1 village are responsible for the Port ofNagoya and it also makes the situation difficult.
n 2 ministries (for transportation and industry supplychains) should be involves addition to the local
governments
n Companies for port handling, warehousing, containertransportation, and other related companies areadditional stakeholders to be coordinated.

Another Cyber-Physical Incident in Marine Transportation (2017)
Cyber-triggered physical consequences at the global level: MARSK Container & Freight Tracking Systemn Individual container status can be monitored in addition to ship navigation status.
n In the event of an incident, it is used to coordinate and negotiate with shipping companies
and business partners.

Another Cyber-Physical Incident in Marine Transportation (2017)
Cyber-triggered physical consequences: global confusions and many servers, PCs, and software replaced

Cyber-attacks_ a digital threat reality affecting the maritime in.pdf

Lessons learnt from the case and further discussion points
Importance of preparedness phase and leveraging knowledges & experiences in natural disaster responses
Lessons learnt
n Importance to establish communication line with the local police before any incidents. It made them able
to recover with in a short term and to keep the incident within a single CI sector.
n Independent data backup is effective but need periodical virus check.
n Public communication at appropriate timings and intervals are important to avoid unnecessary confusions
Further Discussionsn Some industry players in the automotive industry absorbed the impacts of the 2 and half daysʼ disruption
by normal production adjustment for natural disasters(typhoon, flood, snow) and suppliersʼ operationaltroubles.
n However, the difficult part for them in taking response actions was the situation that they could not know
when it would be ended.
n If the expected recovery time would take longer, they were going to activate the wide-area BCP (BusinessContinuity Plan) with the alternative options prepared for the severe earthquake expected in the region.

Agenda3. Important aspects to be discussed for Cyber-Physical Security for CIs

18

Important aspects to be discussed for Cyber-Physical Security in CIs

AgendaConsideration focusing on consequential(resulting) events rather than on cause (trigger) events
n The number of the incidents in CI operations triggered by a cyber cause and resulted in physicalconsequences in the peopleʼs life and socioeconomic activities are still limited.
n However, if we leverage our knowledges and experiences in the consequences after the disruption ofCI operations cause by the natural disasters, simulations and evaluations of consequences after acyber incident can be done.
n Combined approach of ETA (Event Tree Analysis) and FTA(Fault Tree Analysis) will be an effective
way to enrich incident scenarios that can be used for preparedness(e.g. drill & exercises) &response(e.g. proactive defense) phases.
n In order to ensure economic rationality of the investment of management resources (HR/Tools/Money/Information) in cybersecurity, BIA(Business Impact Analysis) and SIA(Social Impact Analysis)
are necessary.
n In the actual incident response by CI providers, it is important to establish a regional cross-CI
community including the local police or investigation agency through periodical information
meetings and cross-sectoral exercises before actual cyber-physical incidents.
19Local professional community for Cyber-Physical CIP (Nagoya-Japan)

AgendaCCSC: A private sector-driven security community for CIP

n As cyber incidents that occur in critical infrastructure are likely to have physical consequences, it isnecessary to ensure coordination and interoperability among CI providers that actually operate in aparticular region, especially in greater metropolitan areas.
n The Chubu Cyber Security Community (CCSC) in the Chubu region (Nagoya) is actually implementing
such efforts, promotes information sharing and the implementation of exercises under a region-specificstructure.
n Local electric power grid company takes a role of a secretariat, and critical infrastructure providers suchas gas, telecommunications, railroads, airport, automotive, and highways, along with prefectural
polices, experts, and specialists.
CIs defined by NISC

CIs defined by the Region

Supporting Agency

Electricity

Gas
Railroad

Telecom

AirportHighway

Automotive

Prefectural Polices
20

Local professional community for Cyber-Physical CIP (US)Case Study: US-InfraGard

AgendaInfraGard: A partnership between FBI and CI operators for CIP

InfraGard is a partnership between the Federal Bureau of Investigation (FBI) and members of the private
sector for the protection of U.S. Critical Infrastructure. Through seamless collaboration, InfraGard
connects owners and operators within critical infrastructure to the FBI, to provide education, information
sharing, networking, and workshops on emerging technologies and threats. InfraGardʼs membership
includes: business executives, entrepreneurs, lawyers, security personnel, military and government
officials, IT professionals, academia and state and local law enforcement̶all dedicated to contributing
industry-specific insight and advancing national security.

n Region-focused CIP
n FBI provide a platform
for education,information sharing,networking, and etc.
n Also responses to theneeds for intelligencesupports
n FBI is supporting theefforts in Japan
Source: https://www.infragard.org/

21

AgendaNext Steps and Challenges

22AgendaNext Steps and Challenges

n Operational integration of cyber and physical security by PPP (Public-Private, Private-Private,Public-Public)-based joint efforts.
n Organically merge the professionals in the both area (Cyber/Physical) into practical CIP operationsn Enhance each region-focused approach(including trial & error) and connect nationwide andinternationally to build resilient CIP network.
n Apply knowledges and experiences of consequential incident responses of CIs in large scale natural
disasters into the Cyber-Physical security for CIs. (Especially in metropolitan areas)“To start from Cyber, or to start from Physical,
that is NOT the question !”23

Thank you
For further discussions:watanabe.kenji@nitech.ac.jp

24