“The next Pearl Harbor we confront could very well be a cyberattack that cripples our power systems, our grid, our security systems, our financial systems, our governmental system,” Leon Panetta, US defence secretary, said at his June confirmation hearing." The difficulty of creating an impregnable defence is pushing western governments to work harder on offense. The US spends 90 per cent of its cyber spending on defence and only 10 per cent on deterrence, the opposite of the balance for traditional arms, said Gen. James Cartwright, vice-chairman of the joint chiefs of staff. He argues that the ratio needs to be flipped. The US needs to convince people that if they attack, “we have the capability and capacity to do something about it”.

Very interesting story from today's FT, FYI,
David

October 11, 2011 5:26 pm

US power plants vulnerable to cyberattack

By Joseph Menn in San Francisco

Assault on the electricity grid could be devastating, writes Joseph Menn

Hundreds of thousands of people in darkness, hospitals in chaos, a banking system under siege – a cyberattack on the US electricity grid could have catastrophic consequences.

When federal researchers discovered that outside hackers could take control of the generators used to produce electricity in the US and destroy them, analysts warned that a co-ordinated assault on the grid could blackout large regions and cause devastation akin to scores of hurricanes striking at once.

Regulators asked utilities to fix that design flaw, as they have with others discovered later.

Now, four years since that first warning, experts say that power plants – along with financial institutions, transportation systems and other infrastructure – have become even more vulnerable.

The economic damage from a single wave of cyberattacks on critical infrastructure could exceed $700bn – or the cumulative toll of 50 major hurricanes ripping into the nation simultaneously, wrote Stanton Sloane when he was chief executive of SRA International.

Sceptics argue that the dangers are being talked up by those eager to be hired to help. Other countries, such as the UK, are also exposed, but officials agree that the US is the most vulnerable to cyberattack because its companies and people are so dependent on the internet.

Many of the utilities that generate the electricity essential for preserving food and maintaining social order could be shut down by even a small team of committed hackers, researchers say. Attacks on military communications, banks and telecoms companies could be even easier, recent espionage cases suggest.

“There are still huge holes in security in energy and other systems, because they were not designed at the beginning with security in mind,” said retired Lt. Gen. Harry Raduege, a former commander of the US military’s network operations task force who is now with Deloitte.

The utilities say that they have a good record on reliability and are improving. But a joint security “road map” issued last month by the US industry and its regulators conceded that threats are evolving “faster than the sector’s ability to develop and deploy countermeasures”. The plan aims to deploy cyber-secure systems by 2020.

In the US and other countries, the grid is divided up by regions, which in theory should limit potential damage to a single region at a time. But a prolonged blackout in New York, Washington or other major hubs could still have a devastating impact – with pronounced food shortages after a week – and malicious software that works in one region could also work in others.

Infrastructure defence in the US is complicated by a patchwork of regulation and ownership and the fact that it is almost always the private sector – not the government – that pays for security upgrades. In other countries, such as China, the government has more control of utilities and a more direct hand in private commerce.

But the US is also perhaps the best equipped offensively. It is widely believed to have been behind the Stuxnet attack last year, which destroyed Iranian nuclear equipment after spreading virally through holes in Microsoft and Siemens software.

Many saw Stuxnet as the dawn of a new era in warfare, the first evidence of the fact that the US, China and others had both great capabilities and vulnerabilities. Since that attack, the Stuxnet code has been circulated in hacking forums. About 85 per cent of the world’s utility networks have been infiltrated by criminals and spy agencies in the past year, up from just over 50 per cent before the discovery of Stuxnet, security company McAfee and the Center for Strategic and International Studies found in a survey this year.

But most alarming for the US defence establishment is the lack of security around the electricity grid. Many power plants, as well as factory floors and pipelines, rely on automation equipment that can be reprogrammed remotely yet do not require even the authentication imposed on average computer users, said John Pollet of Red Tiger Security, which has carried out security assessments on more than 150 facilities: “There is a systemic problem” across all manufacturers of the gear.

Some control systems can be located with special Google searches and then ordered to shut down or speed up, potentially blowing up a power or water treatment plant, presentations at Black Hat hackers conference showed in August. Many of these control systems were designed before the age of widespread internet connections.

The scale of the broader threat has been made clear by the fact that Chinese hackers have penetrated US agencies and tech security companies, including antivirus software company Symantec and other groups that guard federal networks.

This espionage is not only an enormous threat, but it also suggests that serious acts of cyberwarfare would be easy to carry out. “In the cyber realm, the reconnaissance is operationally the more difficult task,” said Michael Hayden, former director of the National Security Agency and the CIA. “Living undetected on a network is far more difficult than disrupting or destroying it once you are inside.”

Even when weaknesses in critical equipment are publicly reported – such as the master password for a Siemens system that was discovered this summer – a diffuse regulatory structure makes it difficult for US officials to do anything about it. The North American Electric Reliability Corp, an industry regulator, doesn’t have control over all utility operators and has been reluctant to adopt stringent safety measures, said Joe Weiss, an author of a book on threats to the grid.

Those struggling to bolster the nations’ defences are only too aware that in cyberspace, the attacker always has the advantage. They only need to find one hole to infiltrate an entire system, while those seeking to protect it need to plug all their security gaps – a seemingly impossible task. That is why cyber ”is an offense-dominant space”, Robert Butler, just-departed Pentagon cyber policy chief, told the Financial Times.

The difficulty of creating an impregnable defence is pushing western governments to work harder on offense. The US spends 90 per cent of its cyber spending on defence and only 10 per cent on deterrence, the opposite of the balance for traditional arms, said Gen. James Cartwright, vice-chairman of the joint chiefs of staff. He argues that the ratio needs to be flipped. The US needs to convince people that if they attack, “we have the capability and capacity to do something about it”.

Copyright The Financial Times Limited 2011.

York, Washington or other major hubs could still have a devastating impact – with pronounced food shortages after a week – and malicious software that works in one region could also work in others.