It’s not news that the lifeline critical functions on which our nation relies are under threat. However, with the evolving geopolitical landscape, that threat is escalating. And with the advent of AI, that threat is accelerating. The foundations of our health and safety are fragile and under duress. Those defending on the frontlines of our critical infrastructure are often “cyber-poor” – lacking in incentives, information, or resources. They need help.
The Institute for Security and Technology is responding to this need. Its Fragile Foundations Sprint will help lifeline critical services become more resilient to cyber and AI-related threats. Over a 100-day sprint, we will examine and address how the lack of resources and cyber capabilities impacts many small-to-medium or rural critical infrastructure operators. The foundational importance of these operators makes them extremely desirable targets for politically-motivated attackers.
IST’s work on UnDisruptable27 highlights and addresses the fragility of water infrastructure and emergency healthcare. Under the leadership of Executive-in-Residence for Public Safety and Resilience, Josh Corman, IST’s work in this area has emphasised the need for broader responses across additional lifeline critical functions where the very real risk of AI- or cyber-caused damage or disruption threatens public health and safety.
For well over a decade, Josh has been dedicated to uncovering and tackling the challenges that expose society to risk at the points where, as Josh puts it, “Bits and bytes meet flesh and blood.” He has immersed himself in the world of lifeline critical functions, and particularly the cyber-poor organizations that are so often overlooked, underserved, or misunderstood by the technology vendor and responder communities.
It’s not surprising that the Fragile Foundations Sprint was Josh’s brainchild, designed to investigate the true impact of disruption on lifeline critical functions and provide cyber-poor operators with pragmatic solutions. The project will also equip policymakers to drive positive change, and lay the groundwork for future initiatives to build on.
I’ll be coordinating and leading the effort with the invaluable partnership of OT/ICS evangelist, David Batz. We are joined by an incredible line up of working group co-chairs that represent a variety of backgrounds and expertise, united under a common desire to build resilience for our most critical services.
The Fragile Foundations Sprint will operate through five working groups:
- Consequences analysis – examining the impacts of damage and disruption to critical services and the current status of operators in these sectors. This effort will be led by Mark Montgomery and Éireann Leverett.
- OT/ICS sector engagement – identifying opportunities to leverage existing stakeholders to increase cyber resilience for resource-constrained critical operators. This effort will be led by Alison King and Mike Holcomb.
- Pragmatic guidance for cyber-poor operators – developing practical recommendations for mitigating cyber threats. This effort will be led by Whitney Bowman-Zatzkin and Samara Moore.
- Novel mitigation analysis – identifying, evaluating, and prioritizing new approaches that respond to the evolving AI threat landscape and the challenges of resource-limited physical environments. This effort will be led by Michael Daniel and Art Manion.
- Policy and incentives design – developing recommendations for policymakers, industry leaders, and others to take forward to further build resilience for critical infrastructure. This effort will be led by Matt Hayden and Megan Samford.
Effective solutions for resilience will often come from non-cyber-oriented approaches. As such and in order to maintain public safety, it is essential that those with AI, cybersecurity, cyber policy and engineering expertise collaborate effectively with the people literally keeping the lights on (not to mention water, healthcare, emergency services, etc!).
With this in mind, we are seeking volunteers with experience in these areas to join our working groups. Please register your interest to help protect our cyber-poor lifeline critical functions. If you are a lifeline critical function operator and would be interested in speaking with us, we want to hear from you! Please reach out to us at [email protected], join our Slack channel, and consider joining one or more of the sprint efforts.
