Slashdot Mirror
TVA Security Lapses Could Endanger US Health, Economy
coondoggie links to a Network World story about myriad security flaws (described in a report from the Governmental Accountability Office) at all levels of the Tennessee Valley Authority, the country's largest public power utility, excerpting: "The Tennessee Valley Authority (TVA) is a federal corporation that generates power using 52 fossil, hydro and nuclear facilities in an area of about 80,000 square miles and has not fully implemented appropriate security practices to protect the control systems used to operate its critical infrastructures, the GAO concluded. TVA's corporate network infrastructure and its control systems networks and devices at individual facilities and plants reviewed were vulnerable to disruptions that could endanger a good portion of the country's economic security and public health and safety, the GAO said."
The TVA is hardly alone, though, when it comes to governmental computer security. Reader bc90021 points out the Federal Government's newly released Computer Security Report Card (prepared for Congressman Tom Davis), which "breaks down the agencies and assigns them all a grade. There are plenty of Fs, not the least of which is for the newly reconnected Department of the Interior."
is that the guy who had his identity stolen? damn, they SHOULD beef up the security.
No wonder the Department of the Interior is insecure, they're six years behind on their patches!
They'll get it done, just give them a chance to catch up on their e-mail and slashdot first.
Prediction: The real iPhone killer is going to be sex robots from Japan. Think about it.
Look we told you that we're TOTALLY working on it. We're going to get those padlocks just as soon as we get paid this month. And we've got this buddy up in Kentucky, that we helped out at this great fucking party last year, who owes us big. And his brother is like this security wizard. We're talking the fucking security zen MASTER and shit. And he's going to be looking at our network just as soon as he can catch a ride down here. So don't worry bro, we're on it! Just chill for a while, okay? You're really harshing our buzz right now.
SJW: Someone who has run out of real oppression, and has to fake it.
More about "The Bunker" it has bedrooms, conference areas, and a whole slew control panels, and server farms. The employee that was with me and I left there and on the way back to my business we were like "If we were the bad guys we could have just caused major mayhem. Needless to say I returned again a couple of months later on a job and instead of just walking in, I got a M16 clad officer at the door. I would think their security is likely better now.. At least I *hope* it is.
P.S. I hope they don't come after me for telling this.
I wrote my master's thesis on SCADA (power system control) network security, and while I'm not surprised TVA is insecure, I never got the impression anyone else was any better.
Media that can be recorded and distributed can be recorded and distributed.
-kfg
I work in an industrial controls field that has a lot of technology in common with the big utilities like TVA. Very little of the remote control software has any sort of security on it. Some systems will have access passwords, but SCADA often has no security at all. An attacker wanting to disrupt services who was familiar with the SCADA equipment and protocols could cause all sorts of havoc by remote control. Imagine the hottest day of the year, power consumption is at its absolute peak, and somebody starts opening breakers, turning off compressors, sending in false failure alarms etc. Pick your time and place carefully and you get one of those cascading failure events and half the eastern seaboard has no lights. Repeat a week later. Maybe not as compelling as kamikaze jetliners, but not without its charms.
None of them can see the clouds; The polished wings don't care.
Just think that with only a fraction of that, they could power the entire country with solar. According to this, we only need 8,500 square miles of solar to power the states.
Things you think are in the Constitution, but are not.
I had a large utility administration customer back in the early 90's. Back then I was constantly shocked (pun intentional) about how vulnerable our power distribution system really was. And the weakest links were frequently the most lightly protected. I even started drafting a novel about a small group of terrorists able to take down the power grid on the entire west coast for months and the effects on society of such an extended outage.
Hopefully grid security is better now, but there's still a lot of lightly protected hardware that will remain difficult to harden.
Ever since then I've kept a 4 Kw generator and extra gas, just in case. Even though I've only needed it a few times in all those years. Our power grid is surprisingly reliable. So much so we tend to take it for granted.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
They've improved security by dressing up in giant M16 costumes? Well, I suppose that would be an improvement. What depresses me is that the departments listed as C, D and F aren't that much different from what they were last year, the year before that, or any other year they've produced these scores. As much as I like NASA, I believe they have the least excuse of any of them, due to the sheer mass of geeks they have working for them. Maybe there should be a suspension on funding for any department that fails to show good faith in improving/maintaining security.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
Most companies would get an 'F'. Government organizations aren't alone in this, and it's the people who do security audits in there best interest to find problems. The will take a tiny risk and blow it way out of proportion.
The Kruger Dunning explains most post on
The internet ate my post. The first one was better. Here's a short version: With all the poorly protected organizations out there, why do we hardly ever hear about this kind of thing? Does the public not notice the damage caused? Or are there not many attacks in the first place? Or is the damaged caused never reported?
Even if they were able to shore up all the issues with TVA, there are countless other services critical to America that could be easily comprimised. For example our nations oil refineries are very loosely guarded; it would be trivial to arrange for a synchronized attack on them and the result would be utterly devastating.
Note to the NSA: I am not a terrorist, please don't take me away.
Sometimes, life itself is sarcasm...
What is the criteria for grading?
I work in IA for the DoD, and there is a lot of stupid stuff that happens, but in the end, the number of minor security incidents is very low, and the number of SERIOUS security incidents is absolutely minuscule. Serious incidents are usually along the lines of information leakage, someone inside doing something stupid without malicious intent.
my point being, this isnt a signal that these departments are insecure because they dont show WHAT theyre grading. are they counting serious incidents? minor ones? number of missed security deadlines? number of workstations with wsus errors? number of MWR personnel that clicked on an exercise phishing link? what??
lots of directives in the government are lists of objectives with deadlines next to them created by a higher-up that doesnt understand any part of it. i am not discounting this "report" entirely, but iv seen this enough times to understand how little it could actually mean, especially considering there is no information provided.
I wonder how much of a stink Tom Davis is going to raise in congress about it, or if he is going to look at it and understand that it tells him nothing.
http://www.tva.gov/cgi-bin/search?txtquery=</title><script>alert('Slashdot was here')</script>
http://tinyurl.com/6h5l52
I don't see how it could be any worse than what the Bushit Administration and Repugnicants have already done to national security and the economy. (Oh and I guess we should blame some of those do-nothing Demoflats too)
I think the terrorists may soon develop the ability to read!
Yep. Ubuntu.