Cyber Attacks on Critical Infrastructure Could Cause Disaster

By | May 22, 2013

Posted in: Network Security Trends

Critical infrastructure in the US –  including the energy sector with its nuclear power facilities – is increasingly coming under cyber attack from hostile nations and a range of other hackers, with potentially disastrous consequences.

The warning was issued earlier this month by Charles Edwards, deputy inspector general of the Department of Homeland Security (DHS), who emphasized the need for streamlined communication between the government and private sector on cybersecurity.

In a briefing to the House Subcommittee on Cybersecurity and Infrastructure Protection and Security Technologies, Edwards raised the specter of malicious users gaining direct control of operational systems in such sectors as energy.

Edwards did not specifically refer to Three Mile Island or Chernobyl, but said, “Successful attacks on Industrial Control Systems (ICS). . . create the potential for large-scale power outages or man-made environmental disasters and cause physical damage, loss of life and other cascading effects.”

Apart from the energy sector, Industrial Control Systems --  many of which are connected to the Internet -- monitor and manage essential processes in areas including agriculture, finance, transport, dams, water supply, communications, emergency services and manufacturing.

“Industrial control systems are increasingly under attack by a variety of malicious sources,” Edwards said. “These range from hackers looking for attention and notoriety to sophisticated nation-states intent on damaging equipment and facilities, disgruntled employees, competitors and even personnel who inadvertently bring malware into the workplace by inserting an infected flash drive into a computer.”

Edwards listed some recent attacks, including “a sophisticated threat actor” – which he did not identify -- that targeted the oil and natural gas subsector in December 2011.

“A recent survey revealed that a majority of the companies in the energy sector had experienced cyber attacks, and about 55 percent of these attacks targeted industrial control systems,” Edwards told the subcommittee.

He said that the DHS was trying to meet the challenge by “addressing the need to share critical cybersecurity information, analyze vulnerabilities, verify emerging threats, and disseminate mitigation strategies.”

The department needed to consolidate its information-sharing and communication efforts with sector-specific agencies and the private sector “to ensure that these stakeholders are provided with potential industrial control system threats and vulnerabilities to mitigate security threats [in a timely way],” Edwards said.

His remarks about information sharing are ironic in light of a recent Reuters report that said the US government itself has become the biggest buyer of exploits designed to break into computers.

The report, published on May 10, said military and intelligence agencies were buying the tools to infiltrate computer networks overseas and leave behind spy programs and cyber-weapons. It said the strategy was spurring concern that Washington was encouraging hacking and failing to tell software companies about the vulnerabilities it was exploiting.

“Spy tools and cyber-weapons rely on vulnerabilities in existing software,” the report said. “These hacks would be much less useful to the government if the flaws were exposed. So the more the government spends on offensive techniques, the greater its interest in making sure that security holes in widely used software remain unrepaired.”

You May Also Be Interested In: