Slashdot Mirror
TVA Security Lapses Could Endanger US Health, Economy
coondoggie links to a Network World story about myriad security flaws (described in a report from the Governmental Accountability Office) at all levels of the Tennessee Valley Authority, the country's largest public power utility, excerpting: "The Tennessee Valley Authority (TVA) is a federal corporation that generates power using 52 fossil, hydro and nuclear facilities in an area of about 80,000 square miles and has not fully implemented appropriate security practices to protect the control systems used to operate its critical infrastructures, the GAO concluded. TVA's corporate network infrastructure and its control systems networks and devices at individual facilities and plants reviewed were vulnerable to disruptions that could endanger a good portion of the country's economic security and public health and safety, the GAO said."
The TVA is hardly alone, though, when it comes to governmental computer security. Reader bc90021 points out the Federal Government's newly released Computer Security Report Card (prepared for Congressman Tom Davis), which "breaks down the agencies and assigns them all a grade. There are plenty of Fs, not the least of which is for the newly reconnected Department of the Interior."
No wonder the Department of the Interior is insecure, they're six years behind on their patches!
They'll get it done, just give them a chance to catch up on their e-mail and slashdot first.
Prediction: The real iPhone killer is going to be sex robots from Japan. Think about it.
Look we told you that we're TOTALLY working on it. We're going to get those padlocks just as soon as we get paid this month. And we've got this buddy up in Kentucky, that we helped out at this great fucking party last year, who owes us big. And his brother is like this security wizard. We're talking the fucking security zen MASTER and shit. And he's going to be looking at our network just as soon as he can catch a ride down here. So don't worry bro, we're on it! Just chill for a while, okay? You're really harshing our buzz right now.
SJW: Someone who has run out of real oppression, and has to fake it.
More about "The Bunker" it has bedrooms, conference areas, and a whole slew control panels, and server farms. The employee that was with me and I left there and on the way back to my business we were like "If we were the bad guys we could have just caused major mayhem. Needless to say I returned again a couple of months later on a job and instead of just walking in, I got a M16 clad officer at the door. I would think their security is likely better now.. At least I *hope* it is.
P.S. I hope they don't come after me for telling this.
I wrote my master's thesis on SCADA (power system control) network security, and while I'm not surprised TVA is insecure, I never got the impression anyone else was any better.
Media that can be recorded and distributed can be recorded and distributed.
-kfg
I work in an industrial controls field that has a lot of technology in common with the big utilities like TVA. Very little of the remote control software has any sort of security on it. Some systems will have access passwords, but SCADA often has no security at all. An attacker wanting to disrupt services who was familiar with the SCADA equipment and protocols could cause all sorts of havoc by remote control. Imagine the hottest day of the year, power consumption is at its absolute peak, and somebody starts opening breakers, turning off compressors, sending in false failure alarms etc. Pick your time and place carefully and you get one of those cascading failure events and half the eastern seaboard has no lights. Repeat a week later. Maybe not as compelling as kamikaze jetliners, but not without its charms.
None of them can see the clouds; The polished wings don't care.
I had a large utility administration customer back in the early 90's. Back then I was constantly shocked (pun intentional) about how vulnerable our power distribution system really was. And the weakest links were frequently the most lightly protected. I even started drafting a novel about a small group of terrorists able to take down the power grid on the entire west coast for months and the effects on society of such an extended outage.
Hopefully grid security is better now, but there's still a lot of lightly protected hardware that will remain difficult to harden.
Ever since then I've kept a 4 Kw generator and extra gas, just in case. Even though I've only needed it a few times in all those years. Our power grid is surprisingly reliable. So much so we tend to take it for granted.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
Most companies would get an 'F'. Government organizations aren't alone in this, and it's the people who do security audits in there best interest to find problems. The will take a tiny risk and blow it way out of proportion.
The Kruger Dunning explains most post on
All we need to do is clear off every structure in those 8,500 square miles, and we're golden!
I don't think that TVA's facilities actually occupy 80,000 square miles (that would be ridiculous). I believe their service area is 80,000 square miles. http://www.tva.gov/sites/sites_ie2.htm
just an analog boy living in a digital age.
What is the criteria for grading?
I work in IA for the DoD, and there is a lot of stupid stuff that happens, but in the end, the number of minor security incidents is very low, and the number of SERIOUS security incidents is absolutely minuscule. Serious incidents are usually along the lines of information leakage, someone inside doing something stupid without malicious intent.
my point being, this isnt a signal that these departments are insecure because they dont show WHAT theyre grading. are they counting serious incidents? minor ones? number of missed security deadlines? number of workstations with wsus errors? number of MWR personnel that clicked on an exercise phishing link? what??
lots of directives in the government are lists of objectives with deadlines next to them created by a higher-up that doesnt understand any part of it. i am not discounting this "report" entirely, but iv seen this enough times to understand how little it could actually mean, especially considering there is no information provided.
I wonder how much of a stink Tom Davis is going to raise in congress about it, or if he is going to look at it and understand that it tells him nothing.