While fences and guards are highly visible reminders to Calgarians about how critical infrastructure is being protected, it is the invisible online world that poses unseen dangers, say experts.

Attacks on control systems can shut down water and electricity, and worse, can take a long time to repair, leaving thousands without basic necessities.

One of the ways that this particular challenge is being addressed is the annual B-Sides cybersecurity conference held at Bow Valley College in Calgary.

Security experts compete in the conferences’ Capture the Flag contest to hack systems that mirror their real-world counterparts to better learn how to protect critical infrastructure.

“If your Gmail gets hacked, it’s unfortunate for you and maybe your family. But if we were to disrupt the flow of natural gas, then potentially there’s less electricity available for a time period, right? If we do damage to the equipment, it can take months to repair, and it can disrupt entire areas,” said Doug Leece, a member of the B-Sides committee and organizer for Capture the Flag.

“People study these things, and a lot of this infrastructure is identifiable online. Some of the times, you can see it right from Google Maps. So people that understand these systems at a complex level definitely have figured out ways to do damage, and they will disrupt our way of life.”

One of the challenges this year has hackers working with control systems that would otherwise be used in the real world to control the flow of natural gas, but at the college, control a pump to blow air into balloons.

Hacking the system allows for the balloons to be exploded.

“There’s a lot of protection mechanisms that go into these industrial control systems, but that doesn’t mean they’re not defeatable. It’s trickier than people think, but it’s far from impossible, and there’s enough public examples of that,” said Leece.

“We’re trying to demonstrate here it’s not as hard as people think. So don’t be thinking it couldn’t happen. But now, how do we go back to the companies we work for and help them work through those resilience plans as well.”

Conference includes students, professionals, and C-Suite executives

He said that one of the good things about the conference is that it draws in a large and diverse set of people involved in cybersecurity, from IT professionals and programmers to executives and members of Calgary’s law enforcement community.

“We’ve got to talk with five leaders of major industrial areas here, and these people came up through the field—now that you’re the leader, how do you balance all of the risks in industrial control systems and get the cyber risk? But then also seeing people figuring out how to get around badges and learning about obscure radio protocols,” Leece said.

James Cairns, Associate Director for IT at Bow Valley College and organizer for B-Sides, said that it was critical to get all of those individuals together.

“People’s minds are peaked there. There’s things that they’re aware of, and whether it’s technical or not, they’re dealing with the next thing that’s coming,” Cairns said.

He said the Capture the Flag competition was also an essential way to provide security training.

“We want to be able to have people in a safe way, to break things so that they can then understand how to build this back better. We want to build back better, we want to build more secure, stronger systems. No system is ever going to be perfect, but it’s definitely going to be that friction point for the malicious actors to get in; it definitely could be a lot harder to get in.”

For the average person, Leece said that the best way to deal with infrastructure threats is to be prepared.

“You definitely need to have some kind of a personal resilience plan in your own world. How much food and water do you have saved in your house, in case there is no water? We went through that last year in Calgary,” he said.

“Figure out that personal resiliency, because critical infrastructure is so widespread. I wouldn’t say it’s as frail as people are making it out to be, but it’s definitely got weak points that could be exploited if we are at a time of war or there’s criminal activity.”

Calgarians looking to be better prepared will have an opportunity to get practical advice during the upcoming Emergency Preparedness Week from May 4 through 10, hosted by the City of Calgary.