OPSWAT Advocates File Regeneration for Critical Infrastructure Security

Benny Czarny, CEO and founder of OPSWAT Inc., argues that conventional detection-based security measures are insufficient for safeguarding critical infrastructure against contemporary threats. In his book, “Cybersecurity Upside Down,” Czarny asserts that artificial intelligence has significantly enhanced the speed and precision of file-borne attacks, rendering the established detect-and-respond paradigm largely obsolete.

Czarny emphasizes that in environments requiring nearly 100% uptime, such as nuclear facilities, defense operations, or crucial financial services, response models are too slow. He points out that taking systems offline for investigation or patching is often not feasible in these critical sectors.

During an interview at Black Hat USA, Czarny discussed OPSWAT's distinct approach to critical infrastructure security. He highlighted that preventing attacks through file regeneration is more effective than relying on detection. Additionally, he noted that peripheral media remains a considerably underestimated attack vector.

OPSWAT’s Deep Content Disarm and Reconstruction (Deep CDR) technology operates on the premise that all incoming files are potentially compromised. Rather than attempting to identify malicious code, Deep CDR analyzes the file's structure and then reconstructs a clean version, mathematically free of any embedded threats. This deterministic process does not depend on signature databases or behavioral heuristics, which can be bypassed by AI-powered attacks.

Czarny explained that this method achieves prevention by assuming all incoming files are malicious and subsequently regenerating a new, malware-free file. This contrasts with traditional detection, which tries to identify and block known threats.

The threats originating from peripheral media extend beyond USB drives to include SD cards, smartphones, contractor laptops, external hard drives, and even charging cables. Czarny highlighted that some device-based threats can masquerade as peripheral media while functioning as network sniffers or remote access tools. Furthermore, USB kill devices can deliver up to 240 volts, capable of physically damaging equipment and causing facility shutdowns.

Czarny refers to the comprehensive interception of all data channels—including file downloads, uploads, email attachments, and peripheral media—as establishing a “firewall of data.” He suggests that this approach significantly enhances an organization's cybersecurity posture and resilience by eliminating numerous potential threats.

For individuals seeking to acquire the necessary skills to implement a preventative security architecture, Czarny recommended OPSWAT Academy. This program has certified nearly 289,000 professionals, with content designed to make cybersecurity concepts accessible and engaging, including modules that challenge common security misconceptions like the absolute effectiveness of traditional firewalls.