Critical infrastructure security faces a novel threat that detection-based defenses weren’t designed to handle. Operators of power grids, water treatment plants and financial systems can’t afford to learn about it the hard way.

Benny Czarny (pictured), chief executive officer and founder of cybersecurity company OPSWAT Inc., makes this argument in his USA Today bestselling book, Cybersecurity Upside Down. Czarny contends that AI has dramatically accelerated the speed and targeting precision of file-borne attacks, making the traditional detect-and-respond model all but obsolete. Response models are dangerously slow in an environment where 99% uptime is not good enough and taking systems offline for investigation or patching is often impossible.

“Whenever we look at critical infrastructure and how to protect it, the network is extremely complex, and you can’t really afford to have any downtime,” Czarny said. “Think about it. You run a nuclear facility, or you run defense, or you are running a very important financial service. Ninety-nine percent is not enough.”

Czarny spoke with theCUBE Research’s Krista Case at Black Hat USA during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed why prevention through file regeneration is more effective than detection for critical infrastructure security, how peripheral media remains a dangerously underestimated attack vector and what OPSWAT’s bootstrapped growth model has meant for its product focus and customer relationships. (* Disclosure below.)

File regeneration shifts critical infrastructure security beyond detection

OPSWAT’s Deep Content Disarm and Reconstruction technology takes a fundamentally different approach to critical infrastructure security. Instead of identifying malicious files, Deep CDR assumes all incoming files are potentially compromised, parses their structure and regenerates a clean version that’s mathematically free of embedded threats. The process is deterministic, meaning it doesn’t rely on signature databases or behavioral heuristics that AI-powered attacks can increasingly evade.

“You achieve prevention through file regeneration, not through detection,” Czarny said. “You assume that all of the file flow to your organization is malicious, and then you regenerate a new file that is malware-free.”

Peripheral media represents one of the most underestimated attack surfaces in operational technology environments. The threats extend beyond USB drives to SD cards, phones, contractor laptops, external drives and even charging cables, according to Czarny. Some malicious hardware masquerades as peripheral media while functioning as a network sniffer or remote access tool, while USB kill devices can deliver an electrical surge of up to 240 volts to a programmable logic controller, physically destroying equipment and shutting down a facility. Mapping and intercepting every data channel is the foundation of what Czarny calls a firewall of data.

“Think about intercepting all of your data flow from file downloads, file uploads, USBs, external peripheral media [and] email attachments,” Czarny said. “If you do that, you can eliminate so many threats and increase your cybersecurity posture and resilience significantly.”

For practitioners looking to get started, Czarny recommended OPSWAT Academy as the most direct path to building the foundational skills necessary to implement a preventive architecture. The program has certified nearly 289,000 professionals to date.

“We make cybersecurity fun and exciting and visual to a point that anybody can understand,” Czarny said. “Episode one is about breaking the firewall — we’re myth-busting that the firewall is effective.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA:

(* Disclosure: OPSWAT sponsored this segment of theCUBE. Neither OPSWAT nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE