Public Perceptions on Securing Critical Infrastructure

Protecting Critical Infrastructure Is Essential

The U.S. public agrees, almost universally, that protecting critical infrastructure is essential to our daily lives, national security, and having a global advantage. Critical infrastructure in this context is defined as “the systems, facilities, and services that are vital for the functioning of our society and economy such as energy, water, transportation, communications, healthcare, and financial systems.”

Key Findings

Percentage of the public that view critical infrastructure…

“Threats to our nation’s critical infrastructure have heightened dramatically as the Chinese Communist Party and others have accelerated their capacity to conduct cyberattacks on our systems. The MITRE-Harris Poll shows that the public is worried about these threats to the vital services we depend on every day, and MITRE is in a unique position to connect government and critical infrastructure providers to take steps now to secure them.” – Charles Clancy, Chief Technology Officer, MITRE

Critical Infrastructure Is Vulnerable to Cyberattacks

Even though most residents (64%) believe that the U.S. has one of the safest and most secure critical infrastructure in the world, 81% are still worried about its safety and security.

Cyberattacks, terrorism and aging/failing infrastructure are considered the greatest risks to our critical infrastructure. Moreover, 75% believe each major critical infrastructure sector is vulnerable to cyberattack, but communications, energy, and financial services are considered the most vulnerable.

Percentage of the public that considers sectors of critical infrastructure vulnerable to cyberattack:

• 78% communications – your local internet and cell phone service always available
• 76% energy – your power always being on
• 76% financial services – your local bank keeping your assets secure
• 75% healthcare – your local hospitals and doctors able to provide medical services
• 73% water and wastewater – your county’s drinking water supply remaining safe
• 72% transportation systems – your region’s trains/roads/buses running smoothly

“The Cybersecurity and Infrastructure Security Agency (CISA) and other government agencies have been beating the drum to wake up critical infrastructure operators and Congress as to the potential threats on our energy, water, communications, and transportation systems. CISA offers numerous resources to help operators prepare for attacks, but more support is needed to counter the increased frequency and sophistication of these threats.” – Yosry Barsoum, Vice President, MITRE

Where Would it Hurt the Most?

If a cyberattack were to occur, where would it hurt the most? The U.S. public, in choosing their top 3 sections of critical infrastructure that would most impact their daily life if they were attacked, rank them at:

• 69% energy
• 57% water and wastewater
• 54% communications
• 53% financial services
• 44% healthcare
• 22% transportation

“In this poll, Gen Z stands out based on substantially lower levels of concerns about security and safety of critical infrastructure vs. any other demographic group. This insight is key reinforcement of Gen Z’s ambivalence to many cybersecurity issues. Although, and likely because, Gen Z are digital natives, they treat privacy and security threats much more lightly than other generations.” – Rob Jekielek, Managing Director, The Harris Poll

Generational Differences

Concern about critical infrastructure is consistent high across all regions of the U.S. Homeowners, urban residents, and people over the age of 27 (Millennials and older) are the most concerned.

While 51% of the public are concerned our critical infrastructure may not recover from an attack, those numbers rise with older generations (59% for Gen X and 56% for Baby Boomers) and rural residents (59%).

“MITRE is working across and with critical infrastructure sectors to test, identify, and remedy their cyber vulnerabilities. But there are hundreds of those organizations, and they all need to evaluate and fortify their emergency plans for cyberattacks, much like they do for natural disaster planning. A well-exercised emergency plan, coupled with effective detection, indication and warning, can thwart even the most sophisticated adversary.” – Chuck Lewis, Managing Director, MITRE

Who’s Responsible?

When it comes to who should bear responsibility for fixing and fortifying our critical infrastructure, 78% believe the federal government bears full or partial responsibility for fortifying it. In particular, 49% say it’s the responsibility of both public and private entities, particularly among older generations (55% for Gen X and 60% for Baby Boomers+) and suburban and rural residents (52% and 54% respectively). Twenty-nine percent believe the federal government is solely responsible, with 35% of urban residents holding this opinion.

Who should be responsible? The public believes…

• 9% put the responsibility on private industry
• 12% put the responsibility on the state and local government
• 29% put the responsibility on the federal government
• 49% put the responsibility on a combination of all three