Cyberattacks on critical infrastructure are a global-connectivity problem because electricity, water, transport, finance, communications, healthcare and manufacturing increasingly depend on connected digital systems. A malicious intrusion that begins in software can therefore interrupt physical services used by people far beyond the compromised computer.
The danger is not simply that “hackers can get in.” It is that critical infrastructure is interdependent. CISA’s Infrastructure Resilience Planning Framework explains that dependencies can multiply impacts: a failure in one service can degrade another infrastructure that depends on it, which can then affect still more systems downstream.
Problems & resilience route: return to the Global Connectivity Problems Hub to compare cyber risk with blackouts, internet outages, payment failures and other shocks. For the healthy system, continue to Cybersecurity and the Global Connectivity Hub.
The cyber layer now controls physical work
Modern infrastructure uses information technology, operational technology, sensors, controllers and remote communications to coordinate physical processes. Pumps, substations, traffic systems, logistics facilities and industrial equipment can all depend on software and communications.
A digital compromise can become a physical interruption
If a cyberattack disables the system that monitors or controls a physical process, operators may lose visibility, lose automated control or choose to shut down equipment for safety. The physical hardware may still exist while the service becomes unavailable.
Critical infrastructure is a dependency network
CISA’s Infrastructure Resilience Planning Framework emphasises identifying the primary and secondary resources that infrastructure needs to operate, as well as downstream services affected when those resources fail. This is the correct lens for cyber resilience: map dependencies before the incident.
The same cyber service can sit underneath many organisations
Several companies may use the same cloud provider, identity platform, software library, managed service or telecommunications carrier. One shared digital dependency can therefore create correlated failure across organisations that otherwise look independent.
Ransomware converts availability into leverage
Ransomware can encrypt data, disrupt systems or threaten disclosure. The operational problem is often availability: an organisation cannot use the information or systems it needs to perform its work. The wider impact depends on what physical or public service sits behind that system.
A Mathematics model of shared dependency
Imagine ten organisations, each with its own local system, but eight use the same identity provider. If that shared provider fails, eight organisations can lose access at once even though none of their local hardware failed. The model is simple, but it shows why counting organisations is not the same as counting independent systems.
Cybersecurity and operational resilience are not identical
Cybersecurity tries to reduce the chance and impact of malicious compromise. Operational resilience asks whether the essential service can continue, adapt or recover even when compromise occurs. A system can be well defended and still need a fallback.
Power and cyber systems are mutually dependent
Digital monitoring and control support modern electricity networks. At the same time, servers, routers and control equipment need electricity. A cyber incident can therefore affect power, while a power failure can degrade cyber capability.
Water systems inherit digital risk
Water and wastewater facilities use pumps, treatment controls, monitoring and communications. An electric outage can stop pumps; a cyber incident can also reduce control or visibility. The same physical service can have several independent failure paths.
Transport inherits digital risk
Traffic management, aviation systems, port operations, ticketing and logistics increasingly depend on networks and software. A transport disruption can begin in a scheduling platform or control system rather than on the road, runway or sea lane.
Finance inherits cyber risk
Banks and payment networks depend on secure identity, communications and data-processing infrastructure. A cyber incident can interrupt authorisation, settlement, customer access or operational coordination even when the underlying money still exists.
Hospitals need cyber continuity, not just data security
Healthcare depends on records, diagnostics, communications, building systems and supply chains. Protecting patient information is important, but so is keeping clinical operations usable during a cyber incident.
Segmentation limits propagation
One resilience principle is to avoid letting every system communicate freely with every other system. Network segmentation and carefully controlled interfaces can reduce the number of systems an attacker can reach from one compromised point.
Backups must be recoverable, not merely present
A backup that is corrupted, inaccessible or too slow to restore does not provide useful resilience. Recovery plans need tested restoration procedures, known priorities and realistic assumptions about what other infrastructure is available during the incident.
A Mathematics model of recovery priority
Suppose four services need 2, 5, 3 and 8 hours to restore, but one specialist team can work on only one at a time. The fastest-first sequence is not automatically best if the 8-hour service supports emergency operations. Resilience scheduling depends on criticality as well as duration.
Incident communication is infrastructure
During a cyberattack, uncertainty can cause duplicated work, unsafe improvisation or public confusion. Clear status reporting, known escalation routes and trusted out-of-band communications help the organisation coordinate while normal systems are degraded.
International dependence makes cyber risk global
CISA’s international critical-infrastructure strategy notes that communications, transportation, information technology, energy, financial services and manufacturing can depend on foreign systems and networks. Cyber resilience therefore cannot stop neatly at national borders.
What cyber resilience looks like
- dependency mapping — know which services rely on which digital and physical systems;
- segmentation — limit how far compromise can spread;
- identity protection — protect privileged and remote access;
- tested backups — ensure critical data and systems can actually be restored;
- manual or alternate procedures — preserve essential work when preferred systems are unavailable;
- incident communications — maintain trusted coordination channels;
- recovery exercises — practise the return path before a real attack.
Singapore as a dense cyber-dependency specimen
Singapore’s finance, logistics, telecommunications, aviation and digital-services sectors create a compact example of cyber-physical interdependence. The featured Marina Bay photograph represents a highly connected urban economy; it does not depict any specific cyber incident.
A paper cyber-dependency activity
Draw five nodes: power, telecoms, water, payments and transport. Add arrows showing what each needs. Then remove the shared identity system or network provider. Ask which services fail directly, which degrade later and which can continue manually. The goal is dependency reasoning, not attack technique.
Vocabulary that clarifies the system
- critical infrastructure — systems and assets whose disruption can seriously affect essential services;
- operational technology — systems used to monitor or control physical processes;
- ransomware — malicious software or activity used to deny access or extort victims;
- segmentation — separating systems to reduce unnecessary reachability;
- shared dependency — one upstream resource used by several otherwise separate systems;
- business continuity — arrangements for continuing essential functions during disruption;
- recovery — restoring trusted operation after an incident.
Frequently asked questions
Is every cyberattack a critical-infrastructure attack?
No. The critical-infrastructure problem appears when the affected digital system supports an essential physical, economic or public service.
Why can several organisations fail at once?
They may share cloud, telecoms, identity, software or managed-service dependencies even if their local systems are separate.
Does disconnecting everything solve cyber risk?
No. Isolation can reduce some exposure but can also remove the connectivity needed for useful operation. The task is controlled connectivity with resilient fallbacks.
Keep the return paths visible
Continue through Cybersecurity, Internet Outages, Power Grid Failures, Payment Network Outages and the Problems Hub.
A final cyber-resilience investigation
Choose one essential service and identify its digital controls, power dependency, communications dependency, one shared third party, one fallback and one recovery step. Keep the exercise defensive and architectural: the goal is to understand resilience, not to reproduce an attack.