Most people picture hackers in hoodies exploiting back doors or using advanced tools to breach firewalls. The reality is frequently much more frightening. Often the easiest way into a system isn’t through code exploits, it’s through people. Let’s explore the hidden threat and see how social engineering puts our critical infrastructure at risk.
Understanding Critical Infrastructure
Critical infrastructure refers to the systems and assets essential to the functioning of society and the economy. The Cybersecurity and Infrastructure Security Agency (CISA) identifies 16 sectors as vital to the U.S., whose failure would severely impact national security and public safety.
These sectors encompass a variety of industries such as:
- Energy: Power grids, oil and gas pipelines
- Water: Treatment facilities and distribution networks
- Transportation: Airports, railways, highways, and traffic control
- Healthcare: Hospitals, emergency services, pharmaceutical supply chains
- Financial Services: Banks, stock markets, payment processors
- Communications: Internet infrastructure, phone and cellular networks
- Government: Public administration, emergency response, military
Critical infrastructure sectors are deeply interconnected, so a disruption in one can quickly ripple through others—causing financial losses, public panic, or even loss of life.
How Social Engineering Targets Critical Infrastructure
Unlike technical “hacking,” social engineering doesn’t necessarily rely on advanced tools. Instead, it leverages an understanding of social interactions and influence techniques to exploit psychological triggers, encouraging people to take specific actions.
Threat actors use a variety of techniques to elicit information including, but not limited to:
- Phishing: Emails that trick people into clicking malicious links, downloading malicious software, or inputting their credentials under false pretexts.
- Vishing: Phone calls or voice messages used to trick individuals into revealing sensitive information like personal information, passwords, login credentials, etc.
- SMiShing: Text messages with similar behavior to phishing emails.
Real-World Examples
Threats to our critical infrastructure systems are occurring on an ever-increasing basis. High-profile examples include the 2021 Colonial Pipeline attack and ongoing ransomware assaults on global healthcare systems. According to the House Homeland Security Committee, cyberattacks on critical infrastructure increased by 30 percent globally in 2023, and 1 in 10 cyber intrusions were due to credentials access.
The Far-Reaching Consequences of a Compromised Infrastructure
Social engineering attacks on critical infrastructure do not just affect the individual entity targeted. The consequences quickly cascade beyond the initial target triggering widespread disruptions across the interconnected systems.
In May 2021, a single compromised password triggered a multi-day infrastructure disruption when the Colonial Pipeline was attacked affecting fuel supplies to the southeastern part of the United States. Transportation networks, including air transport, were impacted due to fuel shortages. Deliveries of essential goods were delayed for manufacturing and commercial purposes. Transportation disruptions can ripple into emergency and healthcare services by delaying patients, staff, and supplies. During the shutdown, public concern prompted panic buying and risky behaviors for transporting fuel. Ransom payments, fuel cost spikes, operational downtime, and loss of public trust caused significant financial damage. These ripple effects can spread far and persist long beyond the initial attack.
Mitigating the Risks of Social Engineering in Critical Infrastructure
Social Engineer, LLC offers a variety of offensive security services that allow companies to see, measure, and improve, the resistance of their employees to the variety of social engineering attacks they may face day to day.
To protect our interconnected sectors, we must prioritize building resistance and resilience against all attack vectors—especially those targeting people.
Written by
Faith Kent
Human Risk Analyst, Social-Engineer, LLC
