UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 6.5 Free with a free account
How Digital Attacks Can Threaten Critical Infrastructure and National Defense
Ethics in Technology · Chapter 6: When Big Data Becomes a Big Risk: Security Gaps, Legal Frameworks, and National DefenseSection 6.5 · lesson 26 of 11617 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: What the Patriot Act Authorizes and How It Changed Government Surveillance Powers →← International Data Protection Frameworks and Cross-Border Compliance ChallengesNext lesson: What the Patriot Act Authorizes and How It Changed Government Surveillance Powers →
In this lesson
Critical infrastructure, industrial controls, cascading impacts, and shared defense.
- Name critical infrastructure sectors and lifelines
- Explain industrial controls and their security constraints
- Trace dependencies and compare documented incidents
- Match defensive measures with owners and government roles
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,871 words). Read along, or search it.
Chapter 6
When Digital Attacks Disrupt Essential Services
A digital incident can interrupt essential services, affecting people far beyond the organization first targeted. Critical infrastructure includes systems whose disruption seriously threatens safety, economic activity, or national security. An attack need not directly change a controller to produce a physical shutdown. Business dependencies and precautionary decisions can also interrupt fuel movement, treatment, or production. We begin with the recognized sectors and four lifelines that support many others. Next, we distinguish office information technology from technology that runs physical equipment. Industrial controls have different components, maintenance constraints, and important safety requirements. We trace an illustrative power outage through communications, water, healthcare, and other dependencies. Documented incidents show different kinds of harm, while uncertain reports require careful attribution. Finally, we compare owners' responsibilities with civilian coordination, military defense, intelligence, and investigation. The defensive goal combines prevention, safe operation, preparedness, and realistic recovery across dependent services.
Critical Infrastructure
16 Sectors Support Safety, Economic Activity, and National Security
The United States recognizes sixteen critical-infrastructure sectors, representing different essential systems and activities. Chemical and commercial facilities include important production, storage, public gathering, and business environments. Communications and critical manufacturing support connectivity and the production of important equipment. Dams and the defense industrial base involve water structures and suppliers supporting military capabilities. Emergency services and energy help communities respond to danger and maintain essential power and fuel. Financial services and food and agriculture sustain payments, credit, production, and food distribution. Government services and facilities, and healthcare and public health, support administration and people's well-being. Information technology, and nuclear reactors, materials, and waste, represent additional specialized infrastructure responsibilities. Transportation systems and water and wastewater systems complete the sector list shown here. Energy, communications, water, and transportation are lifelines, because many other activities depend on them. Ownership includes public and private organizations. Daily operational decisions must connect with wider public coordination.
Industrial Control Systems
Operational Technology Monitors and Controls Physical Processes
Industrial control systems monitor and control physical processes, including electricity generation and water treatment. Operational technology concerns physical equipment, while enterprise information technology supports business and office functions. A sensor measures a condition, such as pressure, temperature, voltage, or fluid flow. A programmable logic controller is a rugged computer that controls equipment according to its configuration. The thermostat comparison illustrates control, although real industrial equipment can be considerably more complex. A human-machine interface presents process information and controls to operators responsible for the activity. Think of an appliance control panel, with much greater operational complexity in a real plant. Supervisory Control and Data Acquisition, or SCADA, supports supervision across equipment and distributed locations. A supervisory server collects information and supports authorized commands within the operating environment. Pipeline pumping stations illustrate why operators may need a coordinated view of distant facilities. These components form an operating system of responsibilities. Protecting only office laptops leaves major questions unanswered.
System Boundaries
Connectivity Creates Dependencies That Need Controlled Boundaries
The source presents a conceptual progression from business applications to supervision, control, and physical equipment. The business layer includes accounts, records, office applications, and services needed by the organization. The supervisory layer includes operator interfaces and systems presenting a coordinated view of operations. The control layer contains devices that directly manage the behavior of equipment and processes. The physical process includes pumps, valves, generators, and the essential service ultimately being delivered. Real architectures vary, so this conceptual arrangement is not a universal diagram for every plant. Connections across these environments need a justified purpose, controlled access, and appropriate protective boundaries. Separation reduces paths between environments, but its effectiveness depends on design and continuing management. Necessary integration should be evaluated carefully, rather than assuming every connection is safe or essential. An office incident can interrupt operations through uncertainty or dependence on business functions. Defenders therefore examine both access boundaries and the services required to keep operations functioning safely.
Why Protection Is Difficult
Security Changes Must Respect Safety and Operational Constraints
Many older industrial systems were designed when isolated networks were a reasonable operating assumption. Some legacy protocol variants lack built-in authentication, although secure extensions and newer implementations differ. Equipment cannot always be updated as casually as an ordinary office application or laptop. Changes may require specialist testing, scheduled downtime, vendor involvement, and careful checks of physical consequences. Industrial equipment can remain in service for decades, outlasting several generations of office computers. Business integration and remote monitoring introduce additional connections that must be understood and controlled. Remote staff and vendors need managed access, strong authentication, and appropriate limits on their permissions. Factory credentials and unnecessary exposure can create serious risks when left unchanged or unmanaged. Safety and availability strongly shape operational security, alongside confidentiality and integrity where they matter. A tool that unexpectedly freezes a controller can itself create an unacceptable operational hazard. Test protective changes and plan maintenance carefully. Operational constraints require adapted security, rather than abandoning protection.
Worked Cascade
Illustrative City Power Outage: Effects Spread Through Dependencies
Consider the source's illustrative city outage, lasting twenty-four hours after electricity service is interrupted. The time windows explain dependencies; they do not predict a fixed schedule for every city. During the first hour, traffic lights, elevators, and some card-payment terminals may stop working. Hospitals may switch to generators, whose coverage, condition, and fuel determine the available backup. Between one and six hours, some tower batteries weaken and communications become less reliable. That deterioration can affect internet access and people's ability to contact emergency services. Between six and twelve hours, pumping constraints can reduce water pressure and access to fuel. Fuel availability also affects transportation, including vehicles needed to restore other essential services. During the remaining period, refrigeration problems threaten food and medicines while generator fuel becomes scarce. Businesses may close, adding economic disruption to the immediate difficulties experienced by residents. Actual effects depend on preparation and restoration. Protecting dependencies matters alongside protecting each individual system.
Colonial Pipeline, May 2021
A Business-Network Attack Led to a Precautionary Pipeline Shutdown
In May two thousand twenty-one, DarkSide ransomware affected Colonial Pipeline's business information-technology systems. The company initially could not establish whether the compromise threatened its operational environment as well. It halted pipeline operations as a precaution, while disrupted business functions also complicated normal operation. Interrupted movement of gasoline, diesel, and jet fuel contributed to regional shortages and public concern. At a June Senate hearing, the chief executive described the relevant legacy remote-access account. It used single-factor authentication, despite stronger authentication arrangements elsewhere in the company's normal operations. Investigators had not confirmed evidence of operational-technology intrusion at the time of that testimony. That evidence supports a distinction between documented business disruption and an unproven controller compromise. The broader lesson is that business-system disruption can still interrupt delivery of a physical service. Review legacy accounts, protect remote access, test boundaries, and prepare response and continuity arrangements. Multifactor authentication reduces important risks, but no single measure guarantees that every incident will be prevented.
Power and Water Cases
Separate Confirmed Operational Harm from Uncertain Attribution
Ukraine's December two thousand fifteen power-grid incident demonstrated confirmed cyber-induced disruption of electricity service. Attackers obtained remote control-system access, and affected utilities experienced interruption of substations and electricity supply. About two hundred twenty-five thousand customers lost power, with outages lasting several hours. The case emphasizes protected operational access, monitoring, trained response, and preparation to restore essential functions. Oldsmar, Florida, provides a different kind of teaching example because the event's cause remains uncertain. In two thousand twenty-one, officials reported an abnormal increase to a water-treatment chemical setting. An operator noticed the change and reversed it, according to the reported account. The source also records later doubt about whether an outside intrusion caused the event. We should not present that uncertainty as conclusive evidence of a successful external attack. Strong remote-access controls, operator awareness, and reliable records remain useful lessons from the reported situation. Compare the evidence for each case. Similar alarming headlines can conceal very different levels of certainty.
Water and Food Cases
Simple Exposure Risks and Business Disruption Can Affect Essential Supply
In two thousand twenty-three, a water authority in Aliquippa, Pennsylvania, experienced compromise of a station controller. Official reporting identified internet exposure and a default password as important weaknesses in the affected equipment. Operators switched to manual operation, demonstrating the value of a suitable fallback in that particular situation. Change factory credentials and limit unnecessary exposure, while maintaining safe and authorized operational access. Manual operation is not possible everywhere, and it requires trained people, preparation, and testing. Food processing is another essential activity whose interruption can affect supply beyond the immediate company. Ransomware disrupted JBS operations in two thousand twenty-one, including temporary disruption of United States beef processing. The company subsequently reported that it had paid eleven million dollars following the incident. That payment describes the case; it does not establish that ransom payment guarantees successful recovery. Organizations need tested recovery, continuity arrangements, supplier coordination, and an understanding of service dependencies. Water and food cases show why infrastructure defense extends beyond electricity grids and military networks.
Shared Defense
Civilian Coordination, Military Defense, Intelligence, and Investigation Differ
Infrastructure defense requires complementary roles, rather than one agency operating and protecting every essential service. CISA coordinates civilian infrastructure protection and supports threat sharing, advisories, assessments, and incident assistance. Its known-exploited-vulnerability information helps organizations identify threats that have been observed in real incidents. The Department of Defense protects military systems and works with the defense industrial base. United States Cyber Command conducts military cyber defense and operations within its assigned authorities. The National Security Agency provides foreign intelligence and defensive cybersecurity guidance, including relevant defense-sector support. The FBI investigates criminal incidents, pursues offenders, and can assist efforts to recover criminal proceeds. Following Colonial, authorities recovered part of the ransom, illustrating investigation alongside operational recovery efforts. Owners and operators remain responsible for daily access, maintenance, safety, preparedness, and operational response. These organizations include public bodies and private companies, with different resources and operating environments. Coordination helps connect evidence, technical assistance, public consequences, and the decisions needed to maintain essential services.
Sector and International Coordination
Sector Expertise Connects National Guidance with Real Operations
Sector agencies provide expertise that connects national coordination with the practical needs of particular industries. The Department of Energy leads the relevant energy-sector partnership and associated risk-management responsibilities. The Environmental Protection Agency has the corresponding role for water and wastewater infrastructure. Transportation responsibilities involve the relevant authorities, including the Transportation Security Administration's pipeline-security duties. After the Colonial incident, TSA issued cybersecurity requirements for covered pipeline owners and operators. Reporting, designated coordination, and risk-remediation requirements help connect individual incidents with wider defensive action. These requirements evolve, so operators must check which current directions apply to their facilities. Other countries organize similar national functions within their own institutional and legal arrangements. India's National Critical Information Infrastructure Protection Centre is the national nodal organization for that protection. Government bodies coordinate, advise, investigate, or defend according to their particular authority and responsibility. Operators secure and maintain the actual systems. National resilience depends on cooperation across those complementary duties.
Review and Defensive Practice
Match Each Control with a Specific Risk and Dependency
Choose defensive measures by identifying the risk, operating constraints, and the essential service being protected. Appropriate separation reduces paths between business systems and control environments, while managing necessary connections. Multifactor authentication strengthens remote access against risks arising from compromised or reused passwords. Changing default credentials and reducing unnecessary exposure address basic weaknesses in accessible equipment. Test fallback procedures and recovery under realistic conditions, including staffing, safety, and equipment limitations. Share incident information promptly through appropriate channels, supporting assistance and warnings for other operators. Plan resources on which recovery depends, such as communications, fuel, water, suppliers, and trained staff. Now consider a hospital that has backup generators during an extended regional power outage. Its generators still require suitable fuel supplies, maintenance, and people able to operate them. Failed communications and disrupted fuel deliveries can undermine a backup that initially worked correctly. The answer connects dependencies with preparedness. An individual control supports resilience only within its real operating context.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About How Digital Attacks Can Threaten Critical Infrastructure and National Defense
What is critical infrastructure and how many sectors does the United States recognize?
What is the difference between IT and operational technology (OT)?
Why are industrial control systems hard to secure?
What happened in the Colonial Pipeline ransomware attack?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →