Panetta Warns of Dire Threat of Cyberattack on U.S.
nytimes.com
nytimes.com
Instead, we'll see some federal guidelines that do nothing but enrich connected defense IT contractors milking the endless cow of defense spending.
Why are passenger trains loaded with lethal chemicals in the first place?
(And BTW, trains derail even without evil cyber hacker criminals. First YouTube result: http://www.youtube.com/watch?v=xCbOUgr_r-E)
Panetta raises the issue that a combination of attacks could cause loss of life and a new sense of vulnerability among the public. (From the article: "...would cause physical destruction and the loss of life, an attack that would paralyze and shock the nation and create a profound new sense of vulnerability.")
The last time the public had that sudden sense of vulnerability, on 9/11 of course, there was a tremendous and partly counterproductive reaction that we're still dealing with.
It could be smarter to put in place laws to force private companies to report cyberattacks, so the government can understand the scope of the problem, than to pay for the reactive spasms that would follow a successful attack.
They don't want smart - otherwise we'd already be doing the smart thing.
I think Panetta partly wants money, but even more, wants laws changed so that privately-operated infrastructure has to have certain security provisions. His agency can't compel it without a law.
History has shown that market forces are not always sufficient to guard against catastrophic events.
1) Disconnect any computer from the Internet that controls anything that can be compromised.
2) Keep the computers disconnected.
BAM! no Internet connection, no cyber-security threat. Now if you'll excuse me, I'm just going to fire up my Ubuntu terminal and derail a passenger train full of chemicals whilst simultaneously breaking down a dam wall in another terminal window.
Seriously though, I think we're all doomed if dams, nuclear reactors, airports and passenger train networks are as accessible from the Internet as Panetta says they are in the first place...
Almost all of our critical infrastructure is offline, and many of our infrastructure companies air-gap their critical networks. Yet we are all still vulnerable simply because we are using computers.
How do they expect to defend against it?
Wait, no. I'd call tptacek.
I'd start with good design and engineering with due diligence, multiple redundancy, identification and delinking of potential failure points and well trained and equipped emergency response teams.
But they'll probably just hire lots of goons and get them to sit on facebook and stalk the insane.
My employer sells a device that permits one-way connections only: http://www.fox-it.com/en/products/datadiode/. The "one-way" part is trivial, of course - the clever part is in making standard protocols work over such a link.
How many years ago were we up on that stage at defcon while bo2k was demoed ? And 12 years later nation states (Iran) are getting owned by the same old autorun.inf.
While it is possible that a proper license was obtained, it seems extremely unlikely that the IOC would permit there trademark to be used for an operation instigating a terrorist attack against one of its members countries and I am currently unaware of the IOC adopting hacking as a completive sport.
The article states "Mr. Obama ordered sophisticated attacks on the computer systems that run Iran’s main nuclear enrichment plants, according to participants in the program. He decided to accelerate the attacks, which were begun in the Bush administration and code-named Olympic Games,"
Why the heck are they on the internet in the first place?
If Panetta is talking about specific "cyber-defense" capability, L3, or Lockheed (etc.) probably already have a product in the making and fulfills some of these requirements. They just need the law to be passed and the purchase order signed.
What I'm trying to say is that if a nuclear facility got hit and their machines where offline (from the internet) its still possibly to infect the rails using the Stuxnet attack vector.
But yes the claims are sensationalist, a better solution would be to increase security protocols and make standards out of those and have companies follow those in a more strict way.
Translation: Before we loot their databases, we have to reassure them that they are not liable.