Media reports about a cyberattack that forced a British power plant offline for four days should be taken seriously far beyond the United Kingdom. It gives us a glimpse of how the Iran conflict could develop and signals to governments and businesses around the world that they need to be ready for a new battlefield.
The facility reportedly targeted by Iran-linked hackers was relatively small, and the British government has stressed that there was no risk to the wider energy system. That is important context, but it would be a mistake to judge the significance of this attack purely by how much electricity was lost. The question for every country operating critical infrastructure is what happens when the target is bigger.
We have already seen reasons to be concerned elsewhere as well. Water and wastewater systems across at least 12 states in the United States have recently reported cyberattacks. More than 30 community water systems were affected in Minnesota alone. In Georgia, one incident caused a drop in water pressure and led to a boil-water advisory.
The US government has not publicly accused Iran of the attacks, but reports point to a hacker group linked to the Islamic Revolutionary Guard Corps (IRGC). These incidents mark an important shift in cybersecurity.
For years, much of the public conversation around cyberthreats focused on data. People understood that hackers could steal passwords, empty bank accounts, leak personal information or lock a company out of its computer system. Critical infrastructure creates a very different risk because the systems being attacked control parts of the physical world.
For societies to function, electricity has to be generated and distributed, water has to be pumped and treated, transport networks have to operate and telecommunications have to stay online. Increasingly, technology sits underneath all of these systems.
That technology creates enormous efficiencies, but it also creates opportunities for attackers. In the US, authorities have specifically warned about Iranian-affiliated actors targeting internet-connected programmable logic controllers, the industrial technology used to control physical equipment and processes. US agencies have identified activity across water, energy and government services, including attempts that have resulted in operational disruption.
This is the part of the Iran conflict that countries well beyond the Middle East need to consider. Geography offers far less protection in cyberwarfare.
An organisation does not need to be sitting in Tehran or Tel Aviv to find itself caught up in the conflict. Infrastructure thousands of miles away can become a target because of the country it operates in, the technology it uses, its suppliers or simply because an attacker sees an opportunity to cause disruption.
We should also be careful about assuming that the objective of every attack is catastrophic damage. An attacker may want intelligence, disruption, publicity or leverage. They may simply want to demonstrate that they can get in.
That makes smaller incidents important. If an attacker compromises a relatively minor facility, the immediate consequences may be limited, but the access itself can tell us something about capability and intent.
There is another problem which governments cannot afford to ignore: critical infrastructure does not operate in neat isolation.
Energy supports communications, transport, healthcare, finance and industry. Communications underpin payments and emergency services. Water systems need power and digital controls. A successful attack does not necessarily need to bring down an entire national system to create serious consequences if disruption begins to spread through organisations that depend on one another.
This is why resilience now matters just as much as defence.
There is a dangerous temptation in cybersecurity to build strategies around preventing attackers from getting inside. Prevention remains essential, but no government or company can sensibly work on the assumption that every attack will be stopped.
Operators need to know what happens after somebody gets through. Can essential services continue? Can systems be isolated? Are manual controls available where appropriate? How quickly can operations be restored? Do organisations understand which suppliers and connected systems they depend upon?
The FBI has already been advising affected US water utilities to practise how they would revert to manual controls if automated systems were compromised. That is a revealing piece of advice because it acknowledges the reality facing critical infrastructure operators: resilience to cyberattacks ultimately has to include the ability to keep the physical world working when technology fails.
Governments and operators should be reviewing their exposure now, particularly where operational technology is accessible from the internet, checking the security of suppliers and preparing for the possibility that an attacker succeeds despite their defences.
The uncomfortable lesson from the past few weeks is that cybersecurity is becoming about far more than protecting information. When cyberattacks can interfere with electricity and water, cybersecurity becomes part of protecting vital systems that ensure societies continue to function.
We should be preparing on that basis now, because discovering the weaknesses in critical infrastructure during a serious attack would be far too late.
The views expressed in this article are the author’s own and do not necessarily reflect Al Jazeera’s editorial stance.
