April 2009 Archives

Vulnerabilities in the U.S. Power Grid

| | Comments (2)
Bookmark and Share

The article released by the Wall Street Journal on Wednesday has created quite a stir and I've spent a considerable amount of time the past two days asking and answering questions about it.

I think I can say without stepping too far out on a limb that the details in the article are no apocalyptic revelation to those who are paid to worry about these things.  Weaknesses in the SCADA and control system environment have been known for years and the fact that some bad guys have penetrated and mapped the electrical grid is probably not a great shock.  The fact that it was so publicly presented surely focused the issue in a lot of people's minds though so this problem may inch up the priority scale.

Not that things weren't already being done to fix weaknesses in the nation's power grid but getting such a public stage for the problem will undoubtedly get telephones ringing in legislators offices that may in turn force changes more quickly.   

The choice was made years ago, the first time that the formerly closed SCADA/control system environment was connected to the Internet through some organization's admin network or wireless connection.  That first time, when people began to see the incredible convenience of the Internet in remotely managing the switches, sensors and valves of these widely distributed systems, control was lost.  Now these same systems and networks that security professionals fight to keep secure everyday, the same ones you are reading this blog on right now, with all their warts and weaknesses, are the same ones in many cases being used to manage our nation's critical infrastructures.  Unfortunately, these control system weaknesses have been known for some time but startlingly little has been done to address them.  Pogo said it best.

I always get a little nervous when I see a quote from an 'Official' that cautions, "...the motivation of the cyberspies wasn't well understood, and they don't see an immediate threat."  Well they may be right about the immediate threat part (or maybe not) but as for the motivation part, put on your Mr. Wizard pointy hat for a second.  Just what do you think is the motivation of someone, anyone, who hacks (or waltzes unhindered) into company and government networks across the nation, maps key critical infrastructure system environments and leaves behind little presents that may go boom someday.  Here's a hint, the answer is not tea and crumpets at 2:00.

The good news is that both the government and utilities companies are beginning to take this threat seriously and devote the resources to slowly begin fixing the problems.  In fact, there are many SCADA-related conferences during the year where security issues are beginning to get as much attention as efficiency of service delivery.  While visibility is often a double edged sword, it can also be the catalyst that changes the game. 

Escape from Conficker-geddon

| | Comments (1)
Bookmark and Share

So here we are again, a couple of days post-Conficker Armageddon and some people are feeling like they missed the party.  No one has said it yet but I can already see it in some eyes, "Looks like another over-blown security event, hyped by the media and exploited by the security guys."  Really?  It's the old circular question, "did Conficker just not live up to it's hype or did all of the attention we gave it mitigate what might have happened?"  Just like police who see a drop in crime after adding more officers, we always seem to be answering this question after we focus in on specific problems like this.

 

So, did all of the media hoopla and our own internal advisories, coercion and hard work to make sure our systems were patched help us dodge the Conficker bullet?  Just like Y2K, we'll probably never know for sure but you know, I don't think it matters.  Sure we had people scurrying around for a couple weeks but I'll bet all of our systems are in a little better condition now and we probably learned a few things about our IT environment that we wouldn't have ever known.  Here's a crude analogy.  In the Navy, when leadership starts noticing an increase in accidents or trends in work-related mistakes spike up, they often call for a "Safety Stand-down" where entire commands, an in some cases the entire Navy, takes a day or a ½ day to stop all regular work and regroup, focus, get some training and address whatever the major problem seems to be.  Well, I'm choosing to treat Conficker as a "Safety Stand-down."  We'll be gathering some metrics over the next few weeks that will hopefully help tell a good story.

 

I spoke with a few CIO's and CISO's yesterday who did take Conficker seriously and they certainly didn't feel like they wasted time.  In fact, a couple of them felt like they and their folks were better off because of the drills they went through to make sure their systems were clean and healthy.

 

We're not even close to declaring victory because there are still millions of Conficker infected computers out there ready to use your networks for their botnet purposes.  More importantly, all evidence points to the fact that the Conficker writers are very good and we still don't know the end game.  Some experts expect to see additional variants that are even more difficult to patch and remove.

 

For today, I'm happy to have avoided a Conficker melt-down on April Fools Day but we plan to stay vigilant and keep our shields up.  Maybe it's a good time to give your folks a pat on the back and tell them "job well done!"

Categories