Critical infrastructure security faces a novel threat of the sort that detection-based defenses were never designed to handle, and the critical personnel who run our power grids, water plants and financial systems can’t afford to learn this the hard way.

Benny Czarny (pictured), CEO and founder of OPSWAT Inc., makes this argument clear in his USA Today bestselling book, Cybersecurity Upside Down. Czarny said AI has dramatically accelerated the speed and targeting precision of file-borne attacks, making the traditional detect-and-respond model all but obsolete. Response models are dangerously slow in an environment where 99% uptime is not good enough and taking systems offline for investigation or patching is often impossible.

“Whenever we look at critical infrastructure and how to protect it, the network is extremely complex, and you can’t really afford to have any downtime,” Czarny said. “Think about it. You run a nuclear facility, or you run defense, or you are running a very important financial service. 99% is not enough.”

Czarny spoke with Krista Case at Black Hat USA during an exclusive broadcast on theCUBE, SiliconANGLE Media’s livestreaming studio. They discussed why prevention through file regeneration is more effective than detection for critical infrastructure security, how peripheral media remains a dangerously underestimated attack vector and what OPSWAT’s bootstrapped growth model has meant for its product focus and customer relationships. (* Disclosure below.)

Critical infrastructure security demands prevention through file regeneration

OPSWAT’s Deep Content Disarm and Reconstruction technology takes a radically disparate approach to critical infrastructure security. Instead of identifying malicious files, Deep CDR assumes all incoming files are potentially compromised, parses their structure and regenerates a clean version that’s mathematically free of embedded threats. The process is deterministic, meaning it doesn’t rely on signature databases or behavioral heuristics that AI-powered attacks can increasingly evade.

“You achieve prevention through file regeneration, not through detection,” Czarny said. “You assume that all of the file flow to your organization is malicious, and then you regenerate a new file that is malware-free.”

Peripheral media represents one of the most underestimated attack surfaces in OT environments. The threats go well beyond USB drives, including SD cards, phones, contractor laptops, external drives and even charging cables, Czarny noted. Device-based threats consist of hardware that masquerades as peripheral media while functioning as a network sniffer or a remote access tool. USB kill devices can deliver up to 240 volts of electrical power to a programmable logic controller, physically destroying equipment and shutting down a facility. Mapping and intercepting every data channel (file downloads, uploads, email attachments and peripheral media simultaneously) is the foundation of what Czarny refers to as a firewall of data.

“Think about intercepting all of your data flow from file downloads, file upload, USBs, external peripheral media, email attachments,” Czarny said. “If you do that, you can eliminate so many threats and increase your cybersecurity posture and resilience significantly.”

For practitioners looking to start, Czarny recommended OPSWAT Academy as the most direct path to building the foundational skills necessary to implement a preventative architecture. The program has certified nearly 289,000 professionals to date.

“We make cybersecurity fun and exciting and visual to a point that anybody can understand,” Czarny said. “Episode one is about breaking the firewall — we’re mythbusting that the firewall is effective.”

Here’s the complete video interview, part of SiliconANGLE’s and theCUBE’s coverage of Black Hat USA:

(* Disclosure: OPSWAT sponsored this segment of theCUBE. Neither OPSWAT nor other sponsors have editorial control over content on theCUBE or SiliconANGLE.)

Photo: SiliconANGLE