Innovation Brief: Post Pandemic Critical Infrastructure
By: Connected Places Catapult
Tags: Infrastructure, Privacy, Green, Coronavirus, Innovation

Horizon 1 — Right Now

Immediate market impacts and shifts from the outbreak — and the possibilities they signal

The sudden, pressing imperative for improved cyber security

With a vast number of organisations “going digital” within days, the need for more robust cybersecurity has grown dramatically. In the initial rush to facilitate home-working, many organisations have seen increased risks due to:

Growth in the number of ‘bring your own’ (i.e. not company issued) devices

Insecure remote-access protocols

A lack of established processes for remote working

‘Insider threats’ — i.e. actions of employees (sometimes malicious, but often accidental — for example clicking on a phishing email)

The use of virtual communication platforms has skyrocketed with employees using software to remotely access corporate networks. These platforms have faced a growing number of cyberattacks, ranging from relatively low impact ‘zoom bombing’, to attackers attempting to penetrate corporate networks through remote ‘home office’ vulnerabilities.

The National Cyber Security Centre (NCSC) has described a range of online attacks through which criminals seek to exploit COVID-19. For instance, individuals have been targeted with COVID-themed phishing emails with infected attachments containing fictitious ‘safety measures’.

New critical infrastructure: new national vulnerabilities

These challenges affect all organisations but are particularly acute for several types of organisation that were never considered part of critical infrastructure pre-COVID. As well as parts of the healthcare ecosystem, logistics companies and supermarkets are now recognised as essential national assets and are prime targets for cyberattacks.

These organisations must reassess their cyber risks, plan for regulatory compliance and implement more sophisticated security frameworks. With reports of key institutions in the fight against the pandemic succumbing to ransomware extortion attacks, these risks are not theoretical, but increasingly urgent.

The vigilance vs. privacy debate heats up — lessons from contact tracing apps

Organisations realising the need to secure their networks are reviewing points of vulnerability. ‘Human vectors’ are often a weak point and it may be tempting for organisations to ramp up efforts to track employee activities to mitigate these risks.

For this approach to be successful, it requires adoption and compliance, in a context of strong legal protections for personal data. Innovators may benefit from the lessons being learned in the roll out of contact tracing apps. Such apps are a key virus control technology which warn people who have been near an infected person to get tested and/or self-isolate.

Many countries are developing and rolling out these apps, with varied degrees of success. In Germany, a country with a strong tradition of data privacy, an app launched in mid-June. The Covid-warn app is compliant with a stringent European standard on location data privacy ( PEPP-PT) but nonetheless is struggling to drive adoption: only 42% of citizens said they would download it. For an app to work effectively, approximately 60% of the population needs to use it.

Other countries such as South Korea have had more success, using more intrusive location tracking technology (and cross referencing with CCTV) among a population more comfortable with such measures.

In a recent virtual roundtable hosted by the Centre for Data Ethics and Innovation (CDEI) people from around ten countries working on contact tracing apps explored various approaches being taken globally to develop such apps. A key theme was the need to balance effectiveness and public trust in the design of the apps. A ‘privacy by design’ approach and a clear communication strategy customised to the culture concerned are important elements of success.

“If, in response to this pandemic, we can match technology with the appropriate institutions, standards and norms, we will emerge stronger than before.” World Economic Forum, April 2020

Security and trust

Strengthening cybersecurity to protect critical infrastructure is essential. This cannot succeed without the support of society. We need to develop tools that can do the job without compromising privacy to the point where citizens rebel. Whether it is enhanced security protocols for remote working or contact tracing apps, they must be unobtrusive, transparent in their purpose and actions, and acceptable to those who will be affected. Privacy by design, proven data security, and total reliability will all help to persuade people to trust.