Based on interviews with several Chief Information Security Officers (CISO) and Chief Information Officers (CIO) responsible for major urban infrastructure such as electric grids and transportation networks, we have concluded that cyber incidents are handled in much the same way as other system outages. System outages generally call into play a previously agreed upon “event response plan” this typically involves bringing backup systems online while the main system is repaired and the public is alerted, especially to interim changes in service.  While this might make sense AFTER a cyberattack against urban infrastructure has occurred, it does not address what infrastructure managers should be doing before an attack occurs to reduce the damage.

Cyberattacks are generally complex and go through multiple stages. Lockheed Martin has created what it calls the Cyber Kill Chain. This categorizes a range of events that typically occur prior to an attack. In our view,  urban infrastructure managers and operators ought to be taking steps to defend against and prepare for each step in the Kill Chain. At present, many are only focused on the final step ("the attacker goal”). Cybersecurity technologies can defend against some of the things that happen during the final stages of the kill chain, but most have not adequately addressed the early stages of cyberattack.

We believe that Defensive Social Engineering (DSE) can provide tools to combat the things that occur during the early stages of an attack where technological solutions are less effective. This is especially true in the case of urban cyber terrorism where attacks tend to be be well thought out attackers spend considerable upfront time preparing. DSE tools can also be used at later stages of an attack to amplify and reinforce the value of technological solutions.

As we develop the DSE toolbox, we will discuss such tools as: cyber negotiation, honeypots and decoy systems, obfuscation techniques, misinformation campaigns, employee education and awareness efforts, devaluing assets upon compromise and proactive defensive signaling. Some of these tools such as employee education and awareness, and honeypots are not new. However, our research is aimed at building a Playbook that explains how to select among defensive social tools in various situations, and how to formulate a broader defensive social engineering strategy to protect urban infrastructure from cyberterrorists.