Slashdot Mirror
Israel's Electric Grid Targeted By Malware, Energy Minister Says (timesofisrael.com)
itwbennett writes: While many are still debating how much risk there is of a catastrophic cyber attack on power grid and other critical infrastructure, Israel's Minister of Infrastructure, Energy and Water, Yuval Steinitz has good reason for warning 'of the sensitivity of infrastructure to cyber-attacks, and the importance of preparing ourselves in order to defend ourselves against such attacks.' On Tuesday Steinitz told attendees at CyberTech 2016 that the country's Public Utility Authority had been targeted by malware just one day earlier, and that some systems were still not working properly. Not long after news of the attack started to spread, Robert M. Lee, the CEO of Dragos Security, published his thoughts on the matter over on the SANS ICS blog.
How do you pronounce "Stuxnet" in the Hebrew language?
There are so many vulnerable SCADA systems, device-specific Ethernet adapters and other stuff out there, and it just chugs along for years and years. Especially with public sector stuff, multiple layers of contractors put gear in, barely document it and hand it over to the operating authority. The problem is that since no one permanent knows the ins and outs of the system, it can stay vulnerable for ages. Even if a vendor does release patches, the "don't touch it or 500K customers lose power" mentality around critical infrastructure means they barely ever get applied.
Anything IoT is going to have to be secure by default, as in, hard to get working instead of open and easy. I doubt the "just contract it out" mentality is ever going to go away in the public sector -- I've inherited systems where the only documentation is a statement of work from 5 years back that the contractor cut and pasted from the vendor's manuals.
And, given the widespread belief Israel was involved in Stuxnet ... to suddenly be bit by this seems a little shortsighted,
I mean, if you (allegedly) did this to someone else, why would you be surprised if it happens to you?
Lost at C:>. Found at C.
I wouldn't blame the news organizations entirely. The Israeli Energy Minister was serving up a nice heaping scoop of FUD and political spin, trying to portray what looks now to just be a garden variety ransomware infection (probably some employee surfing for porn on a work computer) as a big dangerous targeted nation state attack. Certainly, the news folks ate it up, and didn't bother to ask the questions that should arise when you hear wild initial reports like that.
Have you not being paying attention lately?
In a lot of countries someone could have a loud fart and the threat alert would ratchet up ... the world is jumping at shadows these days.
Israel has just been doing it longer.
Lost at C:>. Found at C.