We call it critical infrastructure (CI), because it is. The systems that bring us our water, heat and light, that carry away our sewage and other waste, that connect us to the internet, that guide us through urban centers with coordinated traffic lights — all those and more would upend our lives, safety, health and economy if they failed or even malfunctioned significantly.

我们称其为关键基础架构(CI)。 这些系统可以为我们带来水，热和光，可以带走污水和其他废物，可以将我们连接到互联网，可以通过协调一致的交通信号灯引导我们穿越城市中心，所有这些甚至更多都将破坏我们的生命，安全，健康和经济，如果他们失败了，甚至严重失灵。

But we have grown so accustomed to them that we take them for granted, as if they were as automatic as the sun and the tides. We don’t wonder if the light will come on when we flip the switch. We don’t hold our breath and cross our fingers when we flush the toilet — we push the lever and walk away without a thought.

但是我们对它们已经习以为常，以至于我们认为它们是理所当然的，就像它们像太阳和潮汐一样自动。 当我们按下开关时，我们不会怀疑指示灯是否会亮起。 冲水马桶时，我们不会屏住呼吸，也不会双手交叉–我们推杆，不加思索地走开。

Perhaps not such a good idea. While there have been relatively few incidents that have taken down significant elements of critical infrastructure, some of them have illustrated the ominous possibilities, along with the reality that things connected to the internet cannot be taken for granted.

也许不是一个好主意。 虽然几乎没有什么事件破坏了关键基础设施的重要元素，但其中一些事件说明了不祥的可能性，以及无法将与互联网连接的事物视为理所当然的现实。

And even though U.S. presidents from Bill Clinton through Donald Trump have issued executive orders calling for strengthening U.S. cyber defense of CI, the reminders of vulnerabilities keep coming.

即使比尔·克林顿(Bill Clinton)到唐纳德·特朗普(Donald Trump)的美国总统已经发布行政命令，呼吁加强美国对CI的网络防御，但有关脆弱性的提醒仍在继续。

That could be in part because securing critical infrastructure is not glamorous. It doesn’t call to mind glorious exploration, like the title of one of President Trump’s earlier initiatives in December 2018 — a proposed, “Cybersecurity Moonshot.” It doesn’t involve jets, missiles, bombs and aircraft carrier battle groups.

这可能部分是因为保护关键基础架构并不迷人。 它并没有让人想到光荣的探索，例如特朗普总统在2018年12月提出的一项较早举措的标题-一项拟议的“网络安全Moonshot”。 它不涉及喷气机，导弹，炸弹和航空母舰战斗群。

It’s relative drudgery: finding vulnerabilities in millions of lines of computer code, patching vulnerabilities in water or electrical systems that were never designed to be connected to the internet.

这是相对繁琐的工作：在数百万行计算机代码中查找漏洞，修补从未设计为连接到互联网的水或电气系统中的漏洞。

Cyber is physical

网络是物理的

But it really needs to get done. Because cyberattacks on critical infrastructure could cause just as much, or even more, damage than missiles or bombs.

但这确实需要完成。 因为对关键基础设施的网络攻击可能造成比导弹或炸弹更大甚至更多的损害。

The examples are not just the internationally famous events like the 2010 Stuxnet attack — attributed to but never officially acknowledged by Israel and the U.S. — that destroyed an estimated 984 uranium enrichment centrifuges in the Iranian nuclear program; and the 2015 Russian attack on Ukraine that brought down a portion of that country’s energy grid in the cold of December.

这些例子不仅是国际知名事件，例如2010年Stuxnet袭击 -归因于以色列和美国，但从未得到官方正式承认-摧毁了伊朗核计划中估计的984铀浓缩离心机； 以及2015年俄罗斯对乌克兰的攻击在 12月的寒冷中摧毁了该国一部分能源网。

They are also regional and local. In September 2018, a series of seemingly random natural gas fires and explosionsupended the lives of thousands of residents in three communities in the Merrimack Valley of Massachusetts, destroying dozens of homes, leaving thousands without gas or heat for months and costing more than $1 billion to repair.

他们也是区域性和地方性的。 2018年9月，一系列看似随机的天然气大火和爆炸破坏了马萨诸塞州梅里马克山谷三个社区的数千名居民的生活，摧毁了数十所房屋，数以千计的居民几个月没有燃气或暖气，耗资超过10亿美元修理。

While an investigation concluded the cause was human error that led to catastrophic excess pressure in gas lines, numerous experts said a cyber attacker who was able to take control of the system and “fool” pressure sensors could do the same thing.

尽管调查得出的结论是人为错误导致气体管线中的灾难性超压，但许多专家表示，能够控制系统和“傻瓜”压力传感器的网络攻击者可能会做同样的事情。

Others, from more recent headlines:

其他，来自最近的头条新闻：

• The September 2019 report by Kaspersky ICS CERT on the “threat landscape for industrial automation systems”found that 41.6% of industrial control system (ICS) computers in the energy sector globally were targeted by cyberattacks in the first six months of the year.

  卡巴斯基ICS CERT在2019年9月发布的有关“工业自动化系统的威胁前景”的报告中发现，今年前六个月，全球能源行业中有41.6％的工业控制系统(ICS)计算机受到了网络攻击的攻击。

• This past December, Siemens reported vulnerabilities in an application server and migration server that, if exploited, could let attackers disrupt power generation.

  去年12月， 西门子报告了应用服务器和迁移服务器中的漏洞，如果利用这些漏洞，攻击者可能会破坏其发电。

• A report issued in January by the industrial security firm Dragos declared that “the number of publicly known attacks impacting ICS environments around the world continues to increase, and correspondingly the potential risk due to a disruptive cyber event impacting the North American electric sector is currently assessed as high.”

  工业安全公司 Dragos在1月份发布的一份报告中说：“影响全球ICS环境的已知攻击的数量持续增加，因此，目前正在评估破坏性网络事件对北美电力部门造成的潜在风险。一样高。”

• In January, the federal Department of Homeland Security (DHS) issued a warning about maintaining the security of software behind the nation’s critical infrastructure, due to threats from hostile nation-states, most specifically Iran.

  1月，由于敌对民族国家(尤其是伊朗)的威胁，联邦国土安全部(DHS) 发布了警告 ，要求维护国家关键基础设施背后的软件安全 。

• Joe Weiss, a control systems cybersecurity expert, in a blog post earlier this year, listed five malicious attacks in 2019, including one against a U.S. utility.

  控制系统网络安全专家乔·韦斯(Joe Weiss)在今年早些时候的博客文章中列出了2019年的五次恶意攻击，其中包括针对美国公用事业的一次恶意攻击。

• Security Week reported earlier this month on an access vulnerability in traffic light controllers made by the Austrian firm SWARCO and deployed in more than 70 countries that could have allowed attackers to take control of the system. Among the possibilities: turn all the lights red, which would create immediate gridlock, or turn them all green, which could cause multiple accidents.

  本月早些时候，《安全周刊》报道了奥地利SWARCO公司制造的交通信号灯控制器的访问漏洞，该漏洞已在 70多个国家部署，可能使攻击者能够控制该系统。 其中一种可能是：将所有指示灯变红，这将立即造成死锁，或者将它们全部变绿，这可能会导致多次事故。

That is only a partial list, of course. And top officials are very much aware of the risk and have been addressing them, at least rhetorically, for some time. For decades we have been hearing dire predictions of a “cyber Pearl Harbor” due to industrial control system (ICS) vulnerabilities in U.S. critical infrastructure that include energy, transportation, water, sewer, food and agriculture, health care, communications — 16 in all, according to the Department of Homeland Security (DHS).

当然，那只是一部分清单。 高层官员非常意识到这种风险，并且至少在言辞上已经解决了一段时间。 几十年来，由于美国关键基础设施中的工业控制系统(ICS)漏洞，包括能源，运输，水，下水道，粮食和农业，卫生保健，通讯，总共有16个漏洞，我们一直在听到关于“网络珍珠港”的可怕预测。根据国土安全部(DHS)的说法。

Many experts say those predictions are hyperbole — that U.S. infrastructure is diverse and resilient enough that there is no chance of the nation, or even a portion of it, going dark for weeks or months at a time.

许多专家说，这些预测是夸大其词的-美国基础设施的多样性和弹性足以使美国，甚至其中一部分没有机会一次连续数周或数月变暗。

But most experts also acknowledge that the existing weaknesses are significant. Joel Brenner, a former senior counsel and inspector general at the National Security Agency (NSA), in a March 2017 report titled “Keeping America Safe: Toward More Secure Networks for Critical Sectors” for the MIT Center for International Studies, wrote, “The digital systems that control critical infrastructure in the United States and most other countries are easily penetrated and architecturally weak, and we have known it for a long time.”

但是，大多数专家也承认，现有的弱点是重大的。 美国国家安全局(NSA)的前高级顾问兼监察长乔尔·布伦纳(Joel Brenner)在2017年3月的MIT国际研究中心题为“保持美国安全：为关键部门建立更安全的网络”的报告中写道：控制美国和其他大多数国家/地区的关键基础设施的数字系统很容易被渗透，并且在体系结构上也很薄弱，并且我们早就知道了。”

In an accompanying blog post, he declared, “The White House has been issuing ineffective directives addressing critical networks like clockwork since the ’90s.”

他在随附的博客文章中宣称：“自90年代以来，白宫一直在发布无效指令，以解决诸如发条等关键网络。”

“Bottom line: Over a quarter-century this nation spent billions of dollars on cybersecurity for key infrastructure, yet we are less secure than we were 30 years ago. Good work on cybersecurity is being done, but most of it involves tactical fixes to immediate problems in a never-ending round of Whac-A-Mole. For a nation that is more dependent than any other on electronic connectivity, this is a losing game.”

“底线：在过去的25年中，这个国家在关键基础设施的网络安全上花费了数十亿美元，但我们的安全性不及30年前。 关于网络安全的良好工作已经完成，但是其中大部分涉及在永无休止的Whac-A-Mole回合中针对眼前问题的战术修复。 对于一个比其他任何国家更依赖电子连接的国家来说，这都是一场失败的游戏。”

Offense, defense or both?

进攻，防守还是两者？

So what would be a winning game? That doesn’t have an entirely clear answer.

那么，什么是胜利游戏？ 那还没有一个完全明确的答案。

There is increasing debate over whether most of the nation’s efforts would be best spent making CI security more resilient — as in better on defense — or focusing more on offense (or at least the threat of offense).

关于国家的大部分努力是否能最好地用于使CI安全更具弹性(如更好地防御)，还是将重点更多地放在犯罪(或至少是犯罪威胁)上，越来越多的争论。

According to Jason Healey, recent rhetoric from the top has become more aggressive. In a post on Lawfare earlier this month, Healey declared that President Trump’s Cyberspace Solarium Commission is leaning more toward offense and steering the national effort to protect CI more toward the military than to civilian sectors.

根据杰森·希利(Jason Healey)的说法，最近高层的言论变得更加激进。 希利在本月初发布的《法律评论》中 ，宣布特朗普总统的网络空间日光浴室委员会更多地倾向于进攻，并且将国家保护CI的努力更多地转向了军事而非民用领域。

Healey, founding director and now senior fellow at the Atlantic Council’s Cyber Statecraft Initiative and senior research scholar in cyber conflict and risk at Columbia University’s School of International and Public Affairs, wrote that previous administrations have focused more on “cybersecurity and resilience, especially through partnerships between the public and private sectors with little to any direct military role.”

Healey是大西洋理事会网络状态专家计划的创始董事，现任高级研究员，也是哥伦比亚大学国际与公共事务学院的网络冲突与风险研究高级学者，他写道，以前的政府更加关注“网络安全和弹性，特别是通过伙伴关系在公共部门和私营部门之间，几乎没有直接的军事作用。”

He acknowledged that President Obama did say in a 2015 speech that “we have to build stronger defenses and disrupt more attacks,” but noted that Obama mentioned the military only in passing.

他承认奥巴马总统在2015年的讲话中确实表示“我们必须建立更强大的防御力并破坏更多的进攻”，但他指出，奥巴马只是在顺便提及了军方。

By contrast, the Solarium Commission “uses hawkish national security language that the ‘federal government and the private sector must defend themselves and strike back with speed and agility’ and with ‘layered deterrence,’” he wrote.

相比之下，日光浴室委员会“使用鹰派的国家安全语言，即'联邦政府和私营部门必须捍卫自己，并以Swift，敏捷的方式和'分层的威慑力进行反击'，”他写道。

But those on the commission itself say things like offense and retaliation are just one layer, and that defense is very much part of the strategy. Robert Morgus, director of one of the task forces of the commission, said “deterrence by denial” is one of three key elements of layered defense.

但是委员会本身说进攻和报复之类的事情只是一层，而防御是战略的重要组成部分。 该委员会其中一个工作组负责人罗伯特·莫格斯(Robert Morgus)表示，“否决威慑”是分层防御的三个关键要素之一。

Quoting political scientist Joseph Nye, one of the “contributing experts” to the report, Morgus said deterrence by denial “must make the cost of aggression ‘unprofitable by rendering the target harder to take, harder to keep, or both.’”

莫格斯引用政治科学家约瑟夫·奈(Joseph Nye)的话说，通过否认这一威慑力量，“必须通过使目标更难以实现，更难以保持或两者兼而有之，使侵略成本'无利可图'。”

Of course, one of the best ways to make a target harder to take is simply to “build security in” to the software that runs it. If an attacker can’t take a target, there is no need for the time, expense and risk of retaliating.

当然，使目标更难采用的最佳方法之一就是简单地“在运行它的软件中建立安全性”。 如果攻击者无法瞄准目标，则无需花费时间，金钱和报复风险。

Indeed, the problem with going on offense in the world of cyber is that, as experts have said for many years, software can level the playing field between nation-state adversaries. Countries like Iran or North Korea, which could never challenge the U.S. militarily, could conceivably do catastrophic damage simply with computer keystrokes from thousands of miles away.

确实，在网络世界中进行攻击的问题在于，正如专家多年以来所说，软件可以平息民族国家对手之间的竞争环境。 可以想象，像伊朗或朝鲜这样的国家，永远不可能在军事上向美国发起挑战，它们仅用数千英里之外的计算机按键就能造成灾难性的破坏。

Prevention means doing the basics

预防意味着做基础

So preventing events like that means better defense — focusing on the basics of software security.

因此，防止此类事件意味着更好的防御-着眼于软件安全性的基础。

Michael Fabian, principal consultant at Synopsys, previously remarked about the 2018 Moonshot report that “information security across the board needs to do fewer ‘transformational’ things and more ‘fundamental’ things.”

Synopsys的首席顾问Michael Fabian此前曾评论过2018年Moonshot报告，称“全面的信息安全需要做更少的“转型”事情，而要做更多的“基本”事情。”

And while Rehan Bashir, managing consultant at Synopsys said the U.S. is “moving in the right direction” to improve the security of critical infrastructure, he added that “it is still not enough.”

Synopsys的管理顾问Rehan Bashir表示，美国正在“朝着正确的方向发展”以改善关键基础设施的安全性，但他补充说，“这还远远不够。”

He said a roadmap to better security exists, and rather than issue grandiose plans every couple of years, U.S. officials simply need to follow it.

他说，存在改善安全性的路线图，美国官员不必每两年发布宏伟的计划，而只需遵循它。

“There is an immense need for organizations to adopt security frameworks such as the NIST [National Institute of Standards and Technology] ‘Framework for Improving Critical Infrastructure Cybersecurity,’” he said.

他说：“组织非常需要采用安全框架，例如NIST(美国国家标准与技术研究院)的“ 改善关键基础设施网络安全的框架 ”。

He cited a report from the U.S. Government Accountability Office (GAO) titled “Critical Infrastructure Protection — Additional Actions Needed to Identify Framework Adopting and Resulting Improvements,” which found that “sector-specific agencies (SSAs) have not developed methods to determine the level and type of adoption of NIST framework to establish processes to secure critical infrastructure.”

他引用了美国政府问责局(GAO)的报告，题为“ 关键基础设施保护-需要采取其他行动来确定框架采用和产生的改进 ”，该报告发现，“特定行业的机构(SSA)尚未制定确定水平的方法。 NIST框架采用何种类型来建立确保关键基础设施安全的流程。”

That could start the nation on the path to treating critical infrastructure with the attention it needs.

这可能会使该国开始在其需要的关注下对待关键基础设施。