{"id":27393,"date":"2019-11-01T21:10:31","date_gmt":"2019-11-01T21:10:31","guid":{"rendered":"https:\/\/one.sightlinemg.com\/c4isrnet\/uncategorized\/2019\/11\/01\/how-to-improve-cyber-training-for-critical-infrastructure-employees\/"},"modified":"2026-08-08T18:22:44","modified_gmt":"2026-08-08T18:22:44","slug":"how-to-improve-cyber-training-for-critical-infrastructure-employees","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/c4isrnet\/opinion\/2019\/11\/01\/how-to-improve-cyber-training-for-critical-infrastructure-employees\/","title":{"rendered":"How to improve cyber training for critical infrastructure employees"},"content":{"rendered":"\n

A brief scan of the news reaffirms that cyberattacks targeting critical infrastructure organizations are on the rise. <\/p>\n\n\n\n

Daily headlines highlight the latest ransomware attacks, data breaches and new phishing techniques, bringing to light an epidemic that has resulted in financial, operational and reputational damage for businesses, governments and the general public alike.<\/p>\n\n\n\n

Today, cyberattacks put a lot more than just our personal data at risk \u2013 threat actors have increased the regularity at which they target the infrastructure that supports mission critical systems, such as power grids, water utilities, healthcare systems, nuclear facilities and emergency services.<\/p>\n\n\n\n

A report from the Ponemon Institute<\/a> revealed a steady rise in cyberattacks against critical infrastructure, stating that \u201cNation-state attacks are especially concerning in the [original technology] sector because they\u2019re typically conducted by well-funded, highly capable cyber criminals and are aimed at critical infrastructure.\u201d<\/p>\n\n\n\n

These critical infrastructure sectors \u2013 of which there are 16 \u2013 ultimately impact how our daily lives function and when attacked could have lasting global effects.<\/p>\n\n\n\n

Just last month E&E News reported on the first cyberattack on the U.S. power grid<\/a> as identified by the North American Electric Reliability Corp (NERC). While nation state reconnaissance has occurred for years, this attack is unique in that it is the first to facilitate \u201cminor impact.\u201d In contrast, other critical infrastructure sectors like healthcare and financial services have suffered the consequences of cyberattacks for over a decade, as personally identifiable information regularly sought can rake in millions on the Dark Web in addition to the many benefits associated with intellectual property theft.<\/p>\n\n\n\n

Critical infrastructure cybersecurity training today<\/b><\/p>\n\n\n\n

As mentioned, cybersecurity is not unknown to critical infrastructure sectors. In response to the integration of information technology systems with operational technology systems and the emergence of the industrial internet of things, an increased focus on risk mitigation and industry and federal regulatory compliance emerged. At the same time, a new challenge came to light – there simply aren\u2019t enough cybersecurity workers to fill the number of open jobs.<\/p>\n\n\n\n

To limit risk, most critical infrastructure organizations provide some level of security awareness training company-wide, but it\u2019s often limited to very basic information, such as how to identify and report a phishing email. Advanced training is not typically given to ordinary workers, and many critical infrastructure stakeholders are never properly briefed on how to handle suspected cyber threats.<\/p>\n\n\n\n

This is a serious problem in today\u2019s connected world where vulnerabilities and cyberattacks can come from anywhere at any time including a remote worker, a contractor, a device or even technology that appears on its surface to be begin, like a smart thermostat.<\/p>\n\n\n\n

To put it into perspective, most of today\u2019s CI organizations remotely monitor the status and location of trains, buses and trucks; they can adjust the flow of crude oil and natural gas through pipelines remotely; water and electricity consumption can be monitored and changed from a centralized location and medical devices can be monitored from half a world away. These conveniences cut costs, increase efficiency and overall make our lives easier \u2013 but as the number of interconnected systems continues to rise, so does the attack surface. As a result, more employees across a CI ecosystem are a threat, whether they know it or not.<\/p>\n\n\n\n

Training needs to go beyond phishing<\/b><\/p>\n\n\n\n

Critical infrastructure organizations can no longer go through the motions of cybersecurity awareness training thinking their technology and security teams are enough to maintain control. Instead, all employees must begin to understand that any interaction with technology can play a role in a cyberattack. This represents a change to both culture and strategy – which is never easy to deploy despite its necessity.<\/p>\n\n\n\n

Ultimately, CI organizations must begin to teach every employee and stakeholder that every person \u2013 no matter their role \u2013 plays an important part in protecting mission critical infrastructure. And not just with scare tactics, but with the knowledge and understanding of how cyberattacks operate and how to handle them.<\/p>\n\n\n\n

Leaders should consider some of the following steps:<\/p>\n\n\n\n