TVA Security Lapses Could Endanger US Health, Economy

coondoggie links to a Network World story about myriad security flaws (described in a report from the Governmental Accountability Office) at all levels of the Tennessee Valley Authority, the country's largest public power utility, excerpting: "The Tennessee Valley Authority (TVA) is a federal corporation that generates power using 52 fossil, hydro and nuclear facilities in an area of about 80,000 square miles and has not fully implemented appropriate security practices to protect the control systems used to operate its critical infrastructures, the GAO concluded. TVA's corporate network infrastructure and its control systems networks and devices at individual facilities and plants reviewed were vulnerable to disruptions that could endanger a good portion of the country's economic security and public health and safety, the GAO said." The TVA is hardly alone, though, when it comes to governmental computer security. Reader bc90021 points out the Federal Government's newly released Computer Security Report Card (prepared for Congressman Tom Davis), which "breaks down the agencies and assigns them all a grade. There are plenty of Fs, not the least of which is for the newly reconnected Department of the Interior."

Comments

Well no wonder

[Sentry21]

No wonder the Department of the Interior is insecure, they're six years behind on their patches!

They'll get it done, just give them a chance to catch up on their e-mail and slashdot first.

Um - why?

[Gat0r30y]

It doesn't make any sense to me to allow any remote access to critical control systems like those described. Why would they want to use anything besides a local network?

On control systems networks, firewalls were bypassed or inadequately configured, passwords were not effectively implemented, logging of certain activity was limited, configuration management policies for control systems software were not consistently implemented, and servers and workstations lacked key patches and effective virus protection. In addition, physical security at multiple locations did not sufficiently protect critical control systems. Ok the physical protections is an issue, but people in charge of major control systems for power generation should be on site - there is no reason to connect these boxes to the wider internet - a local network should be completely sufficient for their needs.

Re:Um - why?

[StickyWidget]

Originally, all process networks were designed like that, completely islanded off and self sufficient. Nothing in, nothing out. And that was fine while the industry was for the most part regulated. There wasn't a need for a large amount of data to be shared, everybody did their own thing according to regulations.

Problem with that method is that there was no incentive to make upgrades to infrastructure and systems under regulation. ZERO. Which has lead to the situation we are in now: We have a first world nation with a third world electric power grid. Costs are rapidly rising, power demands are increasing (thank the internet for that), and the equipment is starting to get so old it can't be replaced anymore.

So now, utilities are finally starting to look at way of improving their business. This means more data needs to flow from teh plant into other areas of the business. That data can be used to plan maintenance upgrades, to cost out fuel, to improve efficiency, to add green power to the mix, etc. Connecting these plants and control centers to each other provides a valuable service, it's just that utilities didn't know jack about securing them.

To put it mildly, a generation plant can save $100,000 - $1,000,000 a year simply by sharing data with optimization consultants on a real-time basis. That's what we call "easy money". And in the absence of federal regulations, that's what they did. Now though, utilities are required to secure their network, most under the NERC CIP standards. Situations like TVA's are going to become very very common in the next few years, and then they are going to simply go away as utilities get the message that security means greater electric reliability.

~Sticky
/I've spent the past 3 years of my life working in SCADA security, and plan several more.

Yeah, I live in Chattanooga...

[tetrahedrassface]

And right beside Chickamauga dam is place that TVA insiders call "The Bunker". I have been in it, it has 4 or 5 (or more) floors underground ( I don't remember). Right after 9/11 I catered an event down in the bunker, no security whatsoever, and we got off on the bottom floor... it was nothing but racks of servers as far as I could see. It looked like something out of a movie. It is HUGE. We hopped onto the elevator came up two floors and got off on the correct floor. From there they can control everything in an emergency if they have to, except if some entity compromises their unsecured computers.

More about "The Bunker" it has bedrooms, conference areas, and a whole slew control panels, and server farms. The employee that was with me and I left there and on the way back to my business we were like "If we were the bad guys we could have just caused major mayhem. Needless to say I returned again a couple of months later on a job and instead of just walking in, I got a M16 clad officer at the door. I would think their security is likely better now.. At least I *hope* it is.

P.S. I hope they don't come after me for telling this.

Re:Yeah, I live in Chattanooga...

[jburton71]

I lived in Chattanooga for about 12 years. Somewhere around 1998 or 1999 I visited the exact place you are talking about with a friend of mine (who was then and still is a TVA IT employee). I was just becoming interested in computers at the time and he told me that he would show me where the TVA kept "the brains" of their operation as he put it. Even at that time I questioned whether or not he could get me into this area and his reply was "nobody will know and even if they did nobody will care".

I went back to Chattannoga to visit my old friend a couple of years ago. He had since moved up the govermental ladder and was more or less "in charge" of certain systems. During my visit he took me back to the place, on a Saturday. There was a single security guard on duty at the entrance. As we entered the guard didn't give us much notice as my friend swiped his ID card and entered a key code. I was holding my friend's laptop bag and the guard never asked to look at it or see it. For all he knew I could have been carrying in a brick of explosives. Once inside, I had access to pretty much any place in the "bunker" that I wanted to go, including various control panels, servers, etc.

Short answer, no their security is not better than it was back then.

This is not a new problem

[HangingChad]

I had a large utility administration customer back in the early 90's. Back then I was constantly shocked (pun intentional) about how vulnerable our power distribution system really was. And the weakest links were frequently the most lightly protected. I even started drafting a novel about a small group of terrorists able to take down the power grid on the entire west coast for months and the effects on society of such an extended outage.

Hopefully grid security is better now, but there's still a lot of lightly protected hardware that will remain difficult to harden.

Ever since then I've kept a 4 Kw generator and extra gas, just in case. Even though I've only needed it a few times in all those years. Our power grid is surprisingly reliable. So much so we tend to take it for granted.