In the Crossfire
Critical Infrastructure in Age of Cyber War.
Read the full report by clicking the link above:
Purpose:
Cyber War Sounds like something out of a sci-fi movie or only an area covert government agencies in the US, Europe and Asia should be paying any attention to. This synopsis of the McAfee report is intended to raise awareness.
In the media
Russia vs Georgia: The second real cyber war has broken out. On August 8th 2008, Russian troops crossed into South Ossetia vowing to defend what they called “Russian compatriots”. As this was taking place, a multi-faceted cyber attack began against the Georgian infrastructure and key government web sites. The attack modalities included: Defacing of Web Sites (Hacktivism), Web-based Psychological Operations (Psyc-Ops), a fierce propaganda campaign (PC) and of course a Distributed Denial of Service Attacks (DDoS).
Major US Oil Companies’ Networks Infiltrated by Spies (January 25, 2010) Three major US oil companies were targeted by sophisticated espionage attacks in 2008; they were unaware of the scope of the problem until the FBI notified them in late 2008 and in 2009. The attacks appeared to be focused on stealing “bid data,” valuable proprietary information about the location and likely yield of oil discoveries around the world. The attackers appear to have taken control of the companies’ networks and sent data to computers elsewhere. In at least one instance, the data stream was traced to a computer in China, but there is no hard evidence linking that country’s government to the attacks. The attacks are sophisticated, targeted, and surreptitious, suggesting that those behind the attacks are well organized and have ample support. <The SANS Institute>.
The report
“In the Crossfire” Was written by the Center for strategic and International Studies (CSIS) and commissioned by McAfee to highlight the very real threats and attacks facing key industries. To supplement this information I have included information from other sources and will give an indication of the source with a link to the original.
Critical Infrastructure owners such as the Oil and Gas are reporting that their network and control systems are under repeated attack. While this is true of everything connected to the internet, the critical infrastructure corporations make for better targets.
What is lost
Apart from cost the most feared loss from attacks is reputation, followed by the loss of personal information about customers. Respondents believe the situation will get worse not better in the future.
Specific to the Oil and Gas industry
Sixty percent of those surveyed reported theft-of-service cyber attacks, with nearly one in three reporting multiple attacks every month. Victimization rates were highest in the oil/gas sector, where three quarters of respondents reported theft-of-service attacks. The oil and gas sector also reported the highest rates of stealthy infiltration—71 percent, as opposed to 54 percent of respondents overall, with more than a third reporting multiple infiltrations every month.
Operational control systems are under attack (SCADA)
Attacks on SCADA systems are especially serious because they can give hackers, direct control of operational systems, creating the potential for large scale power outages or man-made environmental disasters.
Responding to the threat:
Overall, cost was most frequently cited as “the biggest obstacle to ensuring the security of critical networks,” followed by “Lack of awareness of the extent of the risk.” Even in a recession, security is still the top factor in making IT investment and policy decisions. In making IT investment and policy decisions, 92 percent said security was either “vital” or “very important.” Nearly a third of the IT executives surveyed said their own sector was either “not at all prepared” or “not very prepared” to deal with attacks or infiltration by high-level adversaries.
Countering the Threat
Basic, Key security measures are not widely adopted and ¾ of respondents said SCADA or industrial Control Systems (ICS) are connected to the internet or some other IP network.
Participation and partnership
Government-sponsored cyber security cooperation varies widely among owners and operators of critical infrastructure. Participation in government-led partnership initiatives is generally low. When asked how they were involved in developing laws or regulations, about a third (35 percent) of executives said their organization was involved in a government-private sector partnership organization. Participation was more widespread in more horizontal organizations like industry information-sharing associations where more than half (53 percent) said they were members.
Improving Security
When it comes to strategies for improving the cyber security of critical infrastructure, the survey and interview data offer no easy answers. Attackers are increasingly targeting users on an individual basis through phishing and other strategies.
These developments mean that authentication of users and their privileges are growing in importance. Yet over half of all executives (57 percent) said their organization employed only user-names and passwords to authenticate those logging in. The remainder used stronger authentication techniques, like biometrics or tokens, either singly or in combination.
Similarly, if you have confidential data on mobile devices, then you absolutely should be looking to encrypt the data. Mitigate the threat of SCADA systems connecting to the internet or other IP networks. Remote access must be moved to more private networks and not over the internet. Cloud computing offers new security measures as well as creating new vulnerabilities, don’t put all your essential services in the same cloud.
Consider the types of data that could be moved to the cloud and the best cloud model for the given business, vet the security model and practices of the service provider, and set guidelines for hosting accountability.
Governments need to be better organized to confront cyber threats. Industry-to-Industry levels of participation are higher
Conclusion
The survey data shows that computer networks, especially IP-based ones, are now essential to critical infrastructure owners and operators. In the current economic climate, owners and operators, who use IT to improve efficiency, will increase their reliance on networks, in both operational and administrative systems. The data and the interviews show that those critical systems—including operational ones like SCADA/ICS—are operating in a high threat environment, and facing a range of risks, including some very expensive ones. But they also suggest that much can be done to protect those systems, for example through more widespread adoption of key security measures.
If cyberspace is the Wild West, the sheriff needs to get to Dodge City. Governance issues are front and center in any discussion of network security for critical infrastructure. There was a wide range of commentary for example about legal barriers to the possibility of the more widespread use of use technical measures to counter DDOS attacks. And experts discussed the difficulties facing treaties and other efforts in this area.
For owners and operators, the survey shows, their relationships to governments are a key factor in how they handle security. For governments, that relationship is crucial for the defense of national assets. In the absence of technological silver bullets, many executives see regulation—despite its drawbacks—as a way of improving security. And beyond just regulation, the data suggests that in some countries, most notably China, a close relationship between government and owners and operators has helped improve security.
A view from South Africa
South Africa has remained out of the target scope, due to our location and limited bandwidth.
This will change as our bandwidth increases, already parts of Africa have some of the highest activity of late. SEACOM is operational, African West Coast Cable is next on the agenda offering a much bigger pipe which will later merge with UhuruNet a cable around Africa connecting the African continent with Europe, Asia and US internet backbone.
