The new manmade environment of cyberspace is a contested domain, which our critical national infrastructure depends on, which in turn requires greater cooperation for security. As former secretary of defense Chuck Hagel remarked in a September 2014 keynote address, we “are entering an era where American dominance [in] cyberspace—can no longer be taken for granted.”¹ Public and private evidence indicate remarkable upward trends in the cyber threat landscape, especially with observed adversarial and criminal activity throughout our domestic national infrastructure. Actors, motivations, and techniques range widely, yet the potential for significant consequences is undeniable. The president and the interagency...

The discussion of how the US government might respond to cyber attack on critical infrastructure ultimately rests upon the nation’s ability to adapt to complexity and uncertainty. However, we need to understand the technology, risk, and actors at play. The first point of necessary clarification is to understand critical infrastructure as a complex system-of-systems for which policy has only recently formed to articulate its complexity and growing need for cybersecurity. In addition to weaknesses inherent in critical infrastructure due to design, legacy considerations, and environmental dependencies, the realization of burgeoning groups of diverse actors, and worsening threat trends in this...

The US government must first appreciate social realities, corporate motivations, and political precedents before fully developing policy responses to cyber attack on critical infrastructure. The president outlined the national approach to this problem in PPD-21, which asserts that the United States will strengthen critical systems against emerging threats by working across public and private sectors while emphasizing the role of private owners and operators in securing their systems.¹ General Davis reinforced the criticality of this partnership with the private sector when he highlighted that “over 99 percent of the electricity and 90 percent of the voice and communications services that...

The US government has made significant efforts to unify a historically piecemeal federal approach to cybersecurity, especially in response to the threats to our critical national infrastructure—an essential and vulnerable center of gravity of our American way of life. Fortunately, and unlike the after-the fact reforms of the Goldwater-Nichols Act, the federal government is moving proactively to bring about procedural and cultural changes before there is a major loss. This whole-of-government approach provides unprecedented clarity and unity of effort through concise policy, interagency deconfliction, and standing ROEs. All these measures are to be continually refined through exercises and further...

The ability of our nation to withstand a cyber attack on its critical national infrastructure, especially under a mounting threat, depends on the development of the abilities to prevent, detect, investigate, and respond to threats. The simultaneous development of private-sector integration and international consensus is also necessary. While the government has developed clear cyber policy, it must now focus its resources on two of those primary lines of cybersecurity effort for the protection of its critical national infrastructure: prevention through strong stakeholder relationships, and detection and response through public, private, and international unity of effort. It is undeniable that the...

Realizing modern cybersecurity across US critical national infrastructure is a shared responsibility between public and private sectors. Much of the remaining work is in shaping international consensus on norms of state cyber behavior, enforcing private-sector responsibilities that affect US national interests, and continual investment and effort in refining the interagency leadership in this rapidly changing space. The rise in sophistication and frequency of cyber attacks, especially against critical sectors, coupled with antiquated and inadequate security practices and the risks from increasing global interconnectivity all demand national unity of effort and international cooperation and consensus to overcome. Government and corporate leaderships...