In the Dark: Crucial Industries Confront Cyberattacks

Decades ago when the early communications networks were formed, scientists rallied around the joy of sending data at light speed and happily connected once-disparate networks together to create the early stages of the “Internet.”  This capability eventually enabled conversations, money transfers, massive data sharing, and the confluence of convenience and efficiencies unlike any the world had ever experienced before.  Security, or even the possibility of misuse of this amazing creation, was not considered until events such as the Morris Worm demonstrated vulnerabilities.  That lack of attention to security was a mistake, and we have spent 20 years trying to secure a now critical system that was not built to be secure, in the face of a cyber adversary that is eating the financial and infrastructure worlds for lunch, stealing money, intellectual property, and, as we saw with Stuxnet, targeting kinetic infrastructure that can lead to harm and destruction.

Fast forward to 2011, as McAfee releases “In the Dark: Crucial Industries Confront Cyberattacks,” the frightening news is the mistake is being repeated.  The so-called “smart” grid is being created with that renewed joy of convenience and efficiency, and that renewed lack of investment in security.  This report is a follow-up to the report released to McAfee’s 2010 report: “In the Crossfire: Critical Infrastructure in the Age of Cyberwar.” This sequel report surveyed 200 IT security executives from critical electricity infrastructure enterprises in 14 counties, focused on the critical civilian energy infrastructure that depends most heavily on industrial control systems.

Perhaps one of the most frightening findings in the report is the fact that, although the security threat and awareness of the threat have increased exponentially, the energy sector increased its adoption of security technologies by only one percent.  Potential reasoning comprises:

1.  Lack of incentives to invest in a difficult economy in protecting against cyber security vulnerabilities when they are not tangible and have not yet been known to cause harm to the energy sector and 2.  Cyber security investment is made often at the CIO/CISO level as a technology conversation for the technology budget vs. where it really needs to be – at the CEO/CFO level where business risk is assessed.  Cyber security is a business risk – if the lights go out, everyone loses money.

It is our hope that this report electrifies the discussion of securing cyber systems for the sake of our safety.   We want to engage the conversation about incentives – what does it take to get us to protect against a threat which, although we cannot see it yet, could be devastating to public safety, business and the economy?  How do we break the vicious cycle of building great new systems, such as the smart grid, without including security from the ground up?  Are we really going to repeat the fatal flaw of the Internet to save a few dollars in the short term?

The following are some key findings in the report:

Key findings in the CIP report

• Eighty percent of respondents have faced a large-scale denial of service attack
• Twenty-five percent of respondents have been victims of extortion attempts
• More than 40 percent of executives believe that their industry’s vulnerability has increased
• Almost 30 percent believe their company is not prepared for a cyberattack
• More than 40 percent expect a major cyberattack within the next year
• Energy sector increased its adoption of security technologies by only a single percentage point, at 51 percent
• Oil and gas industries increased by only three percentage points, at 48 percent
• Nearly 70 percent of respondents frequently found malware designed to sabotage their systems
• A quarter of respondents reported daily or weekly DDoS attacks

Overall Assessment:

• There has been an increase in cyberattacks on critical infrastructure, yet organizations are unprepared or investing more
• The rate of security adoption is significantly trailing behind the rate at which threat are growing, and critical infrastructure industries have made only modest progress since 2010
• Infrastructures that control systems affecting our everyday lives, such as smart grids, are rising in adoption; yet still do not have proper security from attacks in place.

Tags: critical infrastructure, Cybercrime, enterprise, Public Sector, Stuxnet

Comments are temporarily suspended due to blog maintenance, comments will be available again from Monday 21st May.