The Russians are not coming, they are here. And they’re poised for new age warfare that uses weapons of mass disruption rather than destruction. 

This goes beyond any dispute about Russia trying to sway our elections or possibly using chemical weapons on a former Russian spy in England. The U.S. government’s Computer Emergency Readiness Team released a report on March 15 detailing Russian cyber efforts that targeted “U.S. Government entities as well as organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors.” 

We already knew last year about some cyber intrusions, but officials cast the incident as relatively benign. The new report identifies the fox in our house as Russia, and it gives more chilling details on the widespread efforts to take over industrial control systems, the actual systems that make the infrastructure work. That possibility is what makes this scary.

But this is a bigger U.S. issue. The Bureau of Labor Statistics projects that, outside of the medical and personal care aides needed for our aging population, the highest demand for employees nationwide will be in software development and applications.

What can we do to protect our critical infrastructure beyond developing the right workforce?

1. Prevent intrusion. The U.S. government is trying several fronts, including promoting and coordinating better efforts across 16 critical infrastructure sectors. Early last year, the Department of Homeland Security set up a new critical infrastructure sub-sector, the Election Infrastructure, as it recognized the threat to our electoral systems. And critical infrastructure information-sharing organizations get strong backing from Homeland Security, which has set up an automated information sharing platform that needs strong private sector participation if it is to succeed. A cybersecurity framework of good practices, initiated under President Barack Obama, is being updated. 

2. Detect intrusion and respond. The private sector controls most of the U.S. critical infrastructure, and it must adopt a voluntary cybersecurity framework and share first-line information once a breach is detected. Our government needs to do better, too, and not just in terms of our election systems. The U.S. Defense Department itself is under massive attack, with attack sophistication rising. Although government leaders say they are prepared, independent analysis says they are not.