On Campus Podcast – Critical Infrastructure and College Campuses

Darren Gaddis: From CITI Program, I’m Darren Gaddis, and this is On Campus. Today, critical infrastructure, how it impacts a college campus, and how critical infrastructure and cybersecurity can overlap on campuses. I spoke with Kristina Cone, critical infrastructure and emergency management consultant who has local, state, and federal experience working with multiple sectors including public health, higher education institutions, and law enforcement agencies. As a reminder, this podcast is for educational purposes only. It is not intended to provide legal advice or guidance. You should consult with your organization’s attorneys if you have questions or concerns about relevant laws and regulations discussed in this podcast. Additionally, the views expressed in this podcast are solely those of the guests and do not represent the views of their employers. Hi, Kristina, thank you for joining me today.

Kristina Cone: Hi, Darren, thanks for having me.

Darren Gaddis: To get us started today, would you mind telling our audience a little bit about your background and professional experience?

Kristina Cone: Thank you again for having me, Darren. I started my career in 2015 with the Florida Department of Law Enforcement in domestic security. I was a planner and coordinator for the North Florida Regional Domestic Security Task Force where I deployed as a law enforcement civilian role for over 20 natural disasters, mostly hurricanes, and also for active shooter incidents and civil unrest events. I got my master’s in emergency management and crisis management and most recently have worked as a critical infrastructure specialist at the Department of Homeland Security, Cybersecurity, and Infrastructure Security Agency. I am now working independently on critical infrastructure and emergency management.

Darren Gaddis: Our conversation today is all about critical infrastructure on college campuses. To get us started, broadly speaking, what is critical infrastructure?

Kristina Cone: In the United States, the Congress identifies critical infrastructure under Presidential Policy Directive 21. Critical infrastructures are assets, systems, or networks, both physical and virtual, that are considered vital to the United States that their destruction or incapacitation would have a debilitating effect on economic security, public health or safety or any combination thereof.

Darren Gaddis: With this definition in mind, could you provide us with a few examples of critical infrastructure on college campuses?

Kristina Cone: Yes, that’s an excellent question. There are 16 critical infrastructures defined under the Department of Homeland Security, Cybersecurity, and Infrastructure Security Agency. Campuses, exclusively college campuses, fall under the government facility sector. Some examples on a campus may identify as their entity specific critical infrastructure are server rooms, office of the president, the police department, the main lecture hall if they have one, if they have a dispatch for their law enforcement, or they have a gymnasium that they have all their gatherings at. And it depends on the facility on the campus, which facilities they identify as being critical to their campus.

Darren Gaddis: Knowing what would be considered to be critical infrastructure on a college campus, why should college campus communities be concerned about their critical infrastructure?

Kristina Cone: Critical infrastructure is important to keep the campus running smoothly and safely in day-to-day operations. There are two types of infrastructure, there’s physical and cyber. Campuses are interconnected with both the physical and cyber in identifying, understanding, and analyzing dependencies and interdependencies, allows a campus to be more prepared and resilient against both physical and cyber attacks. Some examples of dependencies are electricity, water, natural gas, information technology, and telecommunications. The college needs these to function their infrastructure. And if these are disrupted, so are their operations. These assets are often targeted because they offer unique services. They may perform sensitive functions, they may contain irreplaceable artifacts or have some sort of value symbolically. To minimize this vulnerability, they must incorporate risk management due to this high profile nature of campuses.

Darren Gaddis: And with this information, how can colleges protect their critical infrastructure?

Kristina Cone: There are tools and trainings out there for colleges to utilize. Some things you can do to protect critical infrastructure are add access controls, implement policies and procedures on how these access controls operate, establish and implement any anti-phishing program, have vulnerability scans done on your systems and networks. Implementing annual refresher trainings like active shooter, cybersecurity awareness, are both beneficial to help bring awareness to the faculty on protecting their critical infrastructure. Another measure you can add is multi-factor authentication. You can also read through www.cisa.gov. It’ll give campuses more information on Presidential Policy Directive 21. The critical infrastructure sectors are all listed on there as well as the education sub-sector. They have cyber awareness fact sheets as well as a link to request a cybersecurity advisor that works in their area. You can work with local emergency management. And there are also consulting companies available that focus on cybersecurity and critical infrastructure that can help your campus.

Darren Gaddis: Now knowing how institutions are best able to protect themselves and their critical infrastructure, what are some examples of incidents that have had an effect on college campuses in recent years?

Kristina Cone: During the pandemic, schools saw an increase in cyber attacks due to the significant increase in transitioning to virtual learning. And then depending on the location will depend on different types of disasters that can disrupt the operations of campuses, such as on the East Coast you have hurricanes or on the West Coast you have wildfires. These types of incidents such as a hurricane on the East Coast would require a school to close down its operations and evacuation of students, faculty, and staff. So then you must also account for the safety of your faculty and staff.

Darren Gaddis: Having more information on types of incidents which impact a college campus, what role do administrators, faculty and staff play in protecting critical infrastructure on their campus?

Kristina Cone: The end users, which on college campuses are the faculty and staff, are key to ensuring that policies and procedures and best practices are followed. Faculty should ensure their computers stay updated. They use strong passwords, use good cyber hygiene practices, and report anything suspicious to campus police or the local authorities. Another key component is for the campus to have standard operating policies and procedures in place. Have the faculty and staff train and exercise the plans and review them annually, adding to or making changes if needed. Campuses should have anti-phishing software installed and have vulnerability scans performed regularly on their systems and networks. Something else that is important for campuses to do to protect their infrastructure is implementing interactive virtual and in-person trainings on cyber awareness, cyber hygiene, and suspicious activity and key identifiers, and even active shooter training like the run, hide, fight method. Lastly, putting up posters with contact information for students or visitors to report suspicious activity will also help college campuses to keep their campus safe.

Darren Gaddis: Kristina, knowing all this information, what else should we know about critical infrastructure in college campuses?

Kristina Cone: Stuff will happen. There is no way to be 100% protective 24/7. But being proactive versus reactive and having preventative measures in place and having your staff and faculty trained and prepared will help to strengthen the disruption of everyday operations on your campus. As information technology becomes more and more integrated with all aspects and functions, not only the functioning of the facilities but also in our daily lives, we must be vigilant because there is an increased risk for wide scale or high consequence events that would impact thousands of people.

Education on cybersecurity is key for you and your college campus. Remember, if you see something, say something. Remembering cyber and physical security have many similarities and overlap. They must also be looked at separately. You can read CISA’s website for more information, and interactive training, and contact for advisors in your area, as well as reporting ransomware activity. SchoolSafety.gov is another resource the federal government launched in 2020 as a collaborative effort to serve as a one-stop access point for information, resource, guidance, and evidence-based practices on a range of school safety topics and threats.

If a physical or cybersecurity event does occur at your college campus, you will work with several different outside agencies that may include the FBI, the Department of Homeland Security, state and local law enforcement, or local emergency management, just to name a few. Getting to know your partners before an event occurs will help your college campus transition from the response phase to the recovery phase quicker and more smoothly so you can resume day-to-day operations as soon as possible. Different states have different legislation in place. Work with your state Department of Education to know more about what they have in place for both cyber and physical attacks and what resources they can provide to your college.

Darren Gaddis: Kristina, thank you for joining me today.

Kristina Cone: Thank you so much for having me, Darren.

Darren Gaddis: Be sure to follow, like, and subscribe to On Campus with CITI Program to stay in the know. If you enjoyed this podcast, you may also be interested in other podcasts from CITI Program, including On Research and On Tech Ethics. You can listen to all of our podcasts on Apple Podcasts, Spotify, and other streaming services. I also invite you to review our content offerings regularly as we are continually adding new courses, subscriptions, and webinars that may be of interest to you, like CITI Program’s Information Security course.