Critical Foundations
Full Title of Reference
Critical Foundations: Protecting America's Infrastructures
Full Citation
President's Commission on Critical Infrastructure Protection, Critical Foundations. Protecting America's Infrastructures (1997). Online Paper. Web
Categorization
- Resource by Type: US Government Reports and Documents
- Threats and Actors: Communications; Private Critical Infrastructure; Terrorists
- Issues: Information Sharing/Disclosure; Public-Private Cooperation
- Approaches: Government Organizations; Private Efforts/Organizations; Technology
Key Words
Computer Network Attack, Cyber Terrorism, Cyber Warfare, Interdependencies, National Cybersecurity Strategy (U.S.), Research & Development, SCADA Systems, Virtual Military Technologies
Synopsis
Executive Summary
Our national defense, economic prosperity, and quality of life have long depended on the essential services that underpin our society. These critical infrastructures—energy, banking and finance, transportation, vital human services, and telecommunications—must be viewed in a new context in the Information Age. The rapid proliferation and integration of telecommunications and computer systems have connected infrastructures to one another in a complex network of interdependence. This interlinkage has created a new dimension of vulnerability, which, when combined with an emerging constellation of threats, poses unprecedented national risk.
The rapid growth of a computer-literate population ensures that increasing millions of people around the world possess the skills necessary to conduct such an attack. The wide adoption of common protocols for system interconnection and the availability of “hacker tool” libraries make their task easier.
Growing complexity and interdependence, especially in the energy and communications infrastructures, create an increased possibility that a rather minor and routine disturbance can cascade into a regional outage. Technical complexity may also permit interdependencies and vulnerabilities to go unrecognized until a major failure occurs.
Coping with increasingly cyber-based threats demands a new approach to the relationship between government and the private sector. Because it may be impossible to determine the nature of a threat until after it has materialized, infrastructure owners and operators—most of whom are in the private sector—must focus on protecting themselves against the tools of disruption, while the government helps by collecting and disseminating the latest information about those tools and their employment. This cooperation implies a more intimate level of mutual communication, accommodation, and support than has characterized public-private sector relations in the past.
The quickest and most effective way to achieve a much higher level of protection from cyber threats is a strategy of cooperation and information sharing based on partnerships among the infrastructure owners and operators and appropriate government agencies.
To facilitate this new relationship between government and industry, new mechanisms will be needed, including sector “clearing houses” to provide the focus for industry cooperation and information sharing; a council of industry CEOs, representatives of state and local government, and Cabinet secretaries to provide policy advice and implementation commitment; a real-time capability for attack warning; and a top-level policy making office in the White House.
Other measures are also required. Infrastructure protection must be ingrained in our culture, beginning with a comprehensive program of education and awareness. This includes both infrastructure stakeholders and the general public, and must extend through all levels of education, both academic and professional.
The federal government must lead the way into the Information Age by example, tightening measures to protect the infrastructures it operates against physical and cyber attack. The government can also help by streamlining and clarifying elements of the legal structure that have not kept pace with technology. Some laws capable of promoting assurance are not as clear or effective as they could be. Others can operate in ways that may be unfriendly to security concerns. Sorting them out will be an extensive undertaking, involving efforts at local, state, federal, and international levels. We have offered a number of preliminary legal recommendations intended to jump-start this process of reform.
Another area where government must lead is in research and development. Some of the basic technology and tools needed to provide improved infrastructure protection already exist, but need to be widely employed. However, there is a need for additional technology with which to protect our essential systems. We have, therefore, recommended a program of research and development focused on those needed capabilities.
Additional Notes and Highlights
Expertise Required: None