Ireland's critical infrastructure 'extremely vulnerable' to cyberattacks, expert warns

James Cox

Ireland's critical infrastructure is "extremely vulnerable" to cyberattacks, a cybersecurity expert has warned.

David Silke is managing director at Centripetal, a cybersecurity threat intelligence company from the US which has its European headquarters in Co Galway.

Mr Silke explained that the company was initially founded by former CIA analysts, some of whom worked on security on Air Force One and in the US military.

He joined the company three years ago when it set up its European HQ in Galway, working with 300 companies that provide cyber threat intelligence across the world.

At the recent Cyber Ireland conference, Mr Silke and the company highlighted "vast lapses in cybersecurity across Ireland", including  349,000 Irish networks (3.6 per cent of the total) which are vulnerable to cyberattacks.

In an interview with BreakingNews.ie Mr Silke explained: "We're seeing very significant vulnerabilities across critical national infrastructure in Ireland. We have around 200 critical national infrastructure organisations that would be in government, higher education, healthcare, anything that is critical to national infrastructure in Ireland. A significant percentage, around 40 per cent or 98 companies, we saw vulnerabilities in their networks.

"We went through that at the conference and highlighted the critical national infrastructure vulnerabilities. We outlined 350,000 networks at risk in Ireland. A network could be one or two devices or multiple devices, there is vulnerability in there that can be exposed and hijacked and became a significant issue.

"A lot of these are automated. These snippers look for something like an old automation system, or something that has not been adequately protected."

Cybersecurity should definitely be a higher priority.

Mr Silke praised the work of the National Cyber Security Centre, but added that the Government has more work to do in protecting Ireland from cyber threats.

"Cybersecurity should definitely be a higher priority," he added.

Mr Silke explained that Ireland is vulnerable to hackers, both commercial and state-backed, who want to start attacks in Ireland "with the potential to spread outward to other countries".

He also said the "reputational damage" for Ireland could be massive if another significant cyberattack in the mould of the HSE one takes place.

Mr Silke pointed to the State's reliance on foreign direct investment (FDI).

If somebody was interested in attacking Ireland today it's highly unlikely it would be physical, a digital attack has the potential to cripple Ireland.

"The reputational damage from a company getting severely damaged, or for us as a country, is something we should think about as well.

"The undersea cables and internet infrastructure we should be concerned about, but if we are seeing 98 critical national infrastructure organisations already with vulnerabilities it only takes one being attacked to cause a significant issue in Ireland.

"We've seen it with attacks on higher education already and the HSE.

"We need to make sure we're using the intelligence we have. You do have state actors focusing on particular vulnerabilities to expose them.

"If somebody was interested in attacking Ireland today it's highly unlikely it would be physical, a digital attack has the potential to cripple Ireland. Our dependency in everyday life in terms of how we access data, how we buy, how we spend, how we just purchase."

Mr Silke also said misuse of AI is a big issue, highlighting the fake video that did the rounds on social media during the presidential election showing Catherine Connolly 'withdrawing" from the race.

"We need robust security systems in place to safeguard that. A key component of digital transformation for Ireland has to be cybersecurity and protection of data and assets.

"You need credible sovereign and national cybersecurity management. I've worked in the FDI space and they will want to know they are fully protected going in and out.

"Centripetal wouldn't have set up in Ireland if we didn't think we could do something different here. Our view is you can be proactive with intelligence, instead of being reactive after an attack, in 98 per cent of cases there is intelligence available before an attack.

"We sometimes struggle to get that message out loud and clear. With this threat landscape it's a message that we can see these vulnerabilities and do something about them.

"Of those 98 companies, many probably don't know they have vulnerabilities.

"I would hope lots of companies will try to use the intelligence we have to be more proactive... a bit like with our health."