- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
Network World - The arsenal of modern weapons that terrorists might someday use to disrupt power grids, gas lines and other parts of the nation's critical infrastructure includes conventional weapons as well as bits and bytes - in other words cyberterror attacks. The cyberthreat to the electricity we use and the water we drink is real, experts say, but there's no need to panic - at least not yet.
"Our research shows that terrorist groups are definitely interested in attacking critical infrastructures," says Eric Byres, research director at the Internet Engineering Laboratory of the British Columbia Institute of Technology in Burnaby. "The good news is that we don't think they have the technical ability yet - in other words, the combined IT and control system skills needed to penetrate a utility network. The bad news is that they're beginning to acquire some of these skills."
Confidential documents about supervisory control and data acquisition (SCADA) systems, for instance, have been found in al Qaeda hiding places in Afghanistan, while the Irish Republican Army has said it plans cyberattacks on crucial supply systems, according to Justin Lowe, principal consultant with PA Consulting Group.
Equally disturbing, talented hackers in many parts of the world are willing to peddle their expertise for the right price or political cause, according to DK Matai, chairman of Mi2g, a London security service provider. "We have evidence of Russian hackers selling their skills to radical Islamic groups," he says.
Few, if any, of the industrial control systems used today were designed with cybersecurity in mind because hardly any of them were connected to the Internet. For the most part, these companies viewed their infrastructures as secure from cyberattacks because of their isolated structure.
However, utilities and factories are now using the Internet to carry SCADA messages from an increasing number of Web-enabled, remote-control systems, according to Joe Weiss, who served as security director at the Electric Power Research Institute in Palo Alto, and its Enterprise Infrastructure Security Initiative before joining KEMA Consulting.
Not only that, but also many of their "private" networks now are built with the help of competitively priced fiber-optic connections and transmission services provided by telecom companies, which have become the frequent target of cyberattacks.
Last year, a power utility crash that was caused indirectly by the Slammer worm paralyzing a leased telecom service. For its SCADA communications network, the utility used a frame relay service, which a carrier provided over its ATM backbone. The ATM network was overwhelmed by the worm, blocking SCADA traffic to substations.
"In some sense, we're always under attack," says Vint Cerf, senior vice president of technology strategy for MCI. "The wonderful thing about the Internet is that everything is connected. The horrible thing about the Internet is that everything is connected."