Slashdot Mirror
At How Much Risk Is the US's Critical Infrastructure? (csoonline.com)
itwbennett writes: There is growing evidence that intrusions into the power grid and other critical infrastructure by hostile foreign nation states are real and happening. But there's "much less agreement over how much of a threat hackers are," writes Taylor Armerding. "On one side are those – some of them top government officials – who have warned that a cyber attack on the nation's critical infrastructure could be catastrophic,"writes Armerding. Others are crying FUD, including C. Thomas, a strategist at Tenable Network Security, who got some attention when he argued in an op-ed that the biggest threat to the U.S. power grid not a skilled hacker, but squirrels, are crying FUD. Who has it right? Agreement seems to coalesce around two points: 1) the cyber security of industrial control systems remains notoriously weak and 2) hostile hackers will improve their skills over time. So, while we haven't reached "catastrophe" yet, a properly motivated terrorist group could become a cyber threat.
Because the former is WAY greater a threat than the latter.
SJW's don't eliminate discrimination. They just expropriate it for themselves.
But they aren't very organized. Once they set up a twitter feed, or at least unionize, I'll start being concerned.
Is a lack of funding after 30 years of minimal tax cuts for workers and massive tax cuts for the folks at the top. Look at Flint Michigan.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
I live in Washington DC. The power goes out regularly because the power lines are overhead and not buried. Arguably DC is a "critical" city in the US. Yet we all survive. The country probably does better when DC is out of commission, like it will be next week with the big snow storm coming. You still need to pay your tribute on time, I mean taxes.
OMG Critical infrastructure should never be connected to the intertubes!!!!!
I work in the industrial control world, some anecdotal things to share...
I've seen access to PLC's running critical water structure completely available via a web browser from anywhere in the world...since fixed. There is movement to close all these holes but the industrial control world moves very slow. It's very conservative, thinking "if it ain't broke, don't fix it" with the definition of broke being physically destroyed. It's easy to be critical of them for this but industrial controls are typically running infrastructure or manufacturing equipment, shutting down either of these for upgrades is very costly.
It also doesn't help that many people doing controls are electrical engineers or technicians who don't understand network technology well and doesn't communicate with the IT department.
Many companies understand that they don't understand and just refuse to put their machines on a network, unfortunately they are missing out the benefits of capturing data about their process, remotely view and troubleshooting faults, etc.
Neither hackers nor squirrels. Physical attacks have already happened in California. A relative few attacks coordinated to occur simultaneously on multiple power stations would do the trick.
I can't remember where I saw it, but in a story about EMPs the author noted that the components that are used to build the transmission stations are only manufactured by one or two companies overseas. The build time on these components is 3-5 years. They don't have spares sitting around.
Yes.. because being indebted to China is a good way to go.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
"The biggest risk is squirrels."
Do these people not understand that these two statements are not contradictory? Does anyone here understand that? The question "who is right" is trivial to answer. Both are.
A cyber attack could be catastrophic, albeit rare. And squirrel outages, due to the comparatively high rate of occurrence combined with the level of damage, are a bigger risk.
As some one whose worked in industrial automation (PLCs and their ancillary products) the infrastructure is most definitely at risk. The only thing keeping terrorism at bay is the technical knowledge necessary to mess with it. Engineers at power stations are old farts, and they like things a certain way, the old way. PLCs communicate to other machines in the field using ancient serial protocols, proprietary back planes, and discreet data points. As Rockwell and Siemens and etc decide they need to wake up to the real world however they are putting more of their data over ethernet, but security is an afterthought, and there's your problem. They are designing security into newer protocols, I actually worked on something called DNP-3, and that specification does have an encryption layer in it. I come on to add AES-256 to an existing implementation. Again, afterthought. The effect out in the field of course is that new impl. will cause disruption, consuming devices will need to be upgraded, and etc. That costs money. And so on. Its rarely the case that one simply needs to add a password to an existing infrastructure. Even if that is all that's needed, it usually will still have a cascading effect.
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Squirrels don't work in groups.
You are so, so very wrong.
The problem is that most people who know that squirrels work in groups are now dead. Very very dead. With Oak trees growing out of their rotting corpses.
Posting anonymously for obvious reasons...
The $800 billion stimulus bill was too small to make an impact and too many states used the money to pay for ongoing expenses rather than investing in infrastructure projects. It should have been two to three times larger. With the baby boomers retiring and the working taxpayers shrinking over the next 20 years, paying more taxes is an inevitable fact of life.
Russia and China already has that capability to take down the entire US power grid.
What would a successful EMP attack look like? The EMP Commission, in 2008, estimated that within 12 months of a nationwide blackout, up to 90% of the U.S. population could possibly perish from starvation, disease and societal breakdown.
http://www.wsj.com/articles/james-woolsey-and-peter-vincent-pry-the-growing-threat-from-an-emp-attack-1407885281
Don't listen to him. He is clearly nuts. I am totally not a squirrel. You can trust me.
The only thing keeping terrorism at bay is the technical knowledge necessary to mess with it.
Doesn't take much technical knowledge to cut cables in an underground vault and shoot transformers with a sniper rifle.
http://www.npr.org/sections/thetwo-way/2014/02/05/272015606/sniper-attack-on-calif-power-station-raises-terrorism-fears
Mostly because it requires coordination and some special skills. The 9/11 terrorists needed to learn how to fly just enough to hit buildings and that required a number of attackers, good organization, and backing. That doesn't mean that the capability didn't exist for planes to fly into buildings for decades, it just wasn't used.
You will also note that hijackings are not a "thing" like they were in the 70s and 80s. 9/11 was both the worst case scenario, and immediately made hijacking much, much harder afterward because hijacking depends on the passengers thinking they have a chance to live if they don't all rush you and take you down. Without that hope of survival, the passengers' fear now becomes what will happen if they *don't* attack the hijackers.
If someone wanted to hit the US power grid and has that capability, they're not going to do it until they can get maximum effect from it, because as soon as it becomes realized as a threat, the grid will not be as simple a target anymore. It will get a lot more secure very quickly. They will get one shot at it.
So to answer your question, lone hackers *can't* make a grid failure happen with their limited capabilities, and state actors will want to keep their target unaware of the actual threat until it is needed, lest the killing stroke be blunted.
If you haven't noticed the financial news today, the US economy is stronger than the world economies because those other idiots choose to cut their budgets and strangle their recovery in the mistaken belief that government spending was bad. In fact, those other idiots are now embracing stimulus.
https://uk.finance.yahoo.com/news/world-stocks-oil-surge-central-125120140.html