At Dawn We Sleep
nytimes.com
nytimes.com
Premise A: "Something must be done."
Premise B: "This is something."
-----------
Conclusion: "This must be done."
I do believe that key pieces of global computer infrastructure are at risk of attack. But the threat will not be eliminated by scaremongering, or by handing POTUS the ability to 'shut down the internet' in the case of an emergency (a situation which would arguably lead to more catastrophic failures than any 'cyber attack').
The obvious thing to do when facing a direct military threat is to step up defense forces (missiles, infantry, warships, whatever) in the area you're expecting to be attacked in. But no such obvious solution exists in the case of 'cyberwarfare'. You can't just 'build a digital fortress' with a pile of bricks. I've yet to hear a sound explanation of how legislation will protect computer infrastructure.
Despite our protestations, the governments of the US, UK, Germany and whoever else probably will pass cyberspace protection laws, that only deprive us of freedoms we've grown accustomed to, do little to secure anything, and drive up barriers to entry in more industries.
There is nothing evident that the consumer public at large can relate to as there is no physical object or clear damage.
Then there is the aspect that a attack from country B upon country A done on the internet is nothing to do with country B in any intended form and is the product of a few people sat at home who have no official right to be doing the attack. The internet allows criminals to expand beyond there physical comuter reach and extend globaly. How do you seperate a milatary attack from a lone gunman or criminal collective? With great difficaulty alas and with that, everything gets labels at the country level and deemed as a official attack.
In a Worls that even at war has standards and a code that is followed, then it is about time perhaps that such a convention/standard was globaly agreed upon to encompass the digital age. Certianly agree that hospitals IT systems are a no go area, I know many a evil black hat hacker adheed to this moral code already, some things are just not cricket. But as a global official agreement, there is nothing.
This sadly lends itself to a World that can be manipluated and in that laws that proctect movies and music far outway the ones to protect Hospitals and patient data and in that the level of money to enforce this is very much biased in one direction sadly. It is the new think of the children meme used as an excuse to enforce control and with that we have the think of the internet attacks has now become the norm. Certainly think about and process them, but in a fair way and not by putting up a large stop sign and thinking that is how you control those doing the bad things when it only impacts those who are upstanding more than not. Can even cause somebody upstanding to become disalusioned and with that add to the issue that is never realy addressed directly.
Hell, Not even taking down the DNS network would do all that much, as most computers that form the backbone of our medical and financial systems use IP addresses, instead of URL's, as their primary method of connecting to other servers. The military doesn't even use the main IP system, they have their own.
As most people who actually work within this world know, the primary way of gaining access to systems are social engineering, system defaults, and insecure handling of access information. The world has gotten smart enough now where practically all of our important infrastructure are very well guarded against these attacks. That isn't to say they don't happen, but it's rare, too rare for the possibilities of a full-scale "cyber-attack."
The headlines before the attack on Pearl Harbor turned out to be delusional. No one can reasonably entertain such a delusion about our adversaries’ capacity to attack us in cyberspace today.
Time has almost run out in this session of Congress, and President Obama will soon issue an executive order that will establish cybersecurity standards for critical infrastructure according to the statements of his top cabinet officials.
For the most part, I was along for the ride on this op ed piece. However, when the authors started suggesting Iran might in some way be behind a Pearl Harbor event, I lost interest. When they suggested new legislation that might hinder my ability to use computers without actually improving security for the US, they lost me completely.
I really dislike statements like this. The latter does certainly not imply the former. There surely wasn't a "Texas Water Utility Taker-downer" published on the Internet. A would-be attacker still needs to understand how to exploit security vulnerabilities. While resources for learning such skills can be found online, it's not as plug-and-play as the Times is portraying it.
Try it sometime if you want to gaze upon the gossamer veil twixt normal western life and 28 days later style chaos.
Eg http://www.shodanhq.com/?q=Rockwell
But yes, as ever, don't do stupid stuff if youre not satisfied with your own safety.
In fact one of the biggest issues with a cyber attack is that we may never know where it came from.
If you believe what you're saying, I am reminded of 1984.
It has not declared war since.
How do you detect that any given country is behind an attack launched by a botnet of American computers?
Heck we still don't know that it was the US who were behind Stuxnet.
Afghanistan? Iraq? Vietnam?
Going to war might not be semantically the same as declaring war, but that doesn't change a thing, within the context at hand.
I also call BS on:
1. The US has not declared war in over 70 _years_. -> Denial of objective reality.
2. In fact one of the biggest issues with a cyber attack is that we may never know where it came from. -> OMG must control internet.
Something must be done, sooner would be better than later.
I would rough out a plan like so:
* CIP companies must upgrade their security, which will be audited by Federal pentesters.
* Their security upgrade will be funded partially through grants.
* Failure to implement security will incur fines sufficient to ruin the company, without exemption.
* Audit findings will incur fines scaled according to the severity of the audit finding.
Note that CIP companies are in a different class than other companies. These companies ensure that life goes on. Water treatment plants, electrical utilities, other similar installations. These companies by their nature ought to be subject to a more careful eye by the public, because the public depends on them.
We're not trying to be alarmist; we're parroting someone trying to be alarmist.
Right. Okay.
Scaring people to manipulate them...I see it happening, I just rarely understand to what end.
Power grabs are a bipartisan affliction.
I'm not familiar with HIPPA privacy regulations - those also might be a reasonable place to start.
Earlier this year, The Washington Post reported on an
overseas hacker who gained control of a small Texas
water utility using Internet tools available to anyone.
The idea is to encrypt everything, use a firewall, and have user account control. There are standards for how to do this safely (NERC-CIP). And isolate every network from the net unless it's absolutely necessary.
Right now we're in a state of flux. The industry will mature as younger engineers with computer backgrounds and an understanding of IT (like me) take over.
These are large scale engineer projects, and it's been said before that trad. engineers are more rigorous in their methods and approach to solutions, as compared to software engineers. And yet, they are taking shortcuts (the internet) which do not live up to the engineering standards of the rest of the system.
For me, the only real solution is to use an isolated network. Yes, there will always be the risk of physical access, but that exists with every solution. By removing critical hardware/software from the internet, you reduce your number of attacks dramatically.
Synchrophasors' value is in comparing voltages across entire synchronous regions[1] to maintain stability and prevent events like the 2003 Northeast blackout. As such, they're essentially national in scale. How do you get information across the country (in roughly real time) without the internet? As you can imagine, replicating huge chunks of the internet is cost prohibitive to even the largest utilities.
Believe me, networking is taken extremely seriously in my industry (electric power), and no device is connected to the internet unless it absolutely has to be. There are plenty of valid concerns; however, progress must still be made. I'm interested to see how this all plays out, and to play my own small part in the development of networked utility infrastructure.
So far, the power grid has been safe from the types of nuisance attacks the water utility in the article saw. I really don't know why water pumps and sanitation systems need to be online. I have a hunch we electrical engineers have a leg up on civil engineers when it comes to computer security. ;)
Something like this could occur if knowledgeable people gained access to the waveforms and ability to read/write breaker controls:
http://articles.cnn.com/2007-09-26/us/power.at.risk_1_genera...
Generally what you want to do is have your internal networks gated by hardened devices communicating over VPN. Disconnection from the Internet is simply not practical anymore, but snooping and attacks can be significantly mitigated. My fine employer works in this area and sells these sorts of devices, I would be happy to email interested parties links to our whitepapers and devices. :-)
Getting owned by some of the shelf hacker tool -- say metasploit or nmap -- is embarrasing.
Nothing in this article gives reason to change my expectation of upcoming cyberattack.
step 1 fear mongering like this step 2 an attack that makes good headlines step 3 legislation requiring registration of computers (pick a means)