Cyber-terrorism And Critical National Infrastructure

News this week has said that the US power grid has been hacked by cyber-spies – which is all rather worrying. It used to be that Critical National Infrastructure (CNI) was owned by the government – it made sense, they were looking out for their citizens etc, etc and importantly, things like security were given a high priority.  However, that has changed and now they are owned by shareholders and so the emphasis is often more on profit and so security tends to play second fiddle to remaining competitive and making money. Add to this the fact that the Internet has enabled remote monitoring (less people, but more cyber-risk) and you can start to see the problem. A hacker today can be sitting in London, controlling a bot network in Russia and targeting America and in the click of a mouse could be targeting Australia routing through China. It’s almost too easy. There is a need to revisit CNI, look at how they can be attacked in the 21st Century and take suitable precautions.

The problem is not just CNI, companies and governments are increasingly putting in ’secret’ or ’secure’ networks, which in theory don’t connect to the Internet. Unfortunately some are finding problems they hadn’t foreseen – firstly virus infections. If you don’t get security updates then the network becomes a breeding ground for worms like Conficker which propagate using USB sticks and other routes. So, what – ‘it’s not attached to the Internet’… ah, there’s the other problem. Eventually, and it doesn’t seem to take long, someone installs a bridge between the ’secret’ network and the corporate network and then the data can leak out. Why does the bridge get installed? Simple… time and money – with very little thought to the risks and consequences.

With a frightening increase in malware around, assumptions on security for CNI and internal secure networks needs to be revisited. Just because you don’t think your network is at risk, doesn’t mean it isn’t. In an economic downturn, the information you have and ignore might just be valuable enough for someone to  steal and sell. Now is not the time to take shortcuts and reduce IT security.

April 9, 2009 | Filed Under Insider, security | Leave a Comment 

Protecting Critical National Infrastructure

Next week is the RUSI conference on Protecting Critical National Infrastructure. I am one of the speakers opening the conference on Wednesday 16th April and will be talking about The Cyber Threat to Critical National Infrastructure. While the focus will be on CNI, many of the threats are just as applicable to any company, whether it is denial-of-service, data-loss or hacking of a company’s critical systems.

April 8, 2008 | Filed Under Speaking | Leave a Comment