Editorial
The shocking image of an electrical generator ripping itself apart in a simulated hacking attack opens a CNN report on SCADA (supervisory control and data acquisition) vulnerabilities.
The computer network attached to the generator has been breached and the SCADA controller settings changed to make it self-destruct.
The report moves on to experts worried about simultaneous cyber attacks that would lay waste to the electrical power infrastructure for months, and features a think tank executive who says such an attack could be like “40 to 50 large hurricanes striking all at once.”
The frightening message was that critical infrastructure – everything from power and water plants to food processing and pipeline systems – is at risk from terrorists. The CNN report ended in a somewhat lame fashion, however, by wondering whether the cyber security holes could be closed “before the hackers find them.”
The report did its best to be sensational, but in fact, it may not have been sensational enough. It could have said that hackers have found lots of holes, they know how to find more and they know what to do with them.
A man named Scott Lunsford hacked into a nuclear power station. It took a day to breach the network and a week to assume complete control. First, people told him it was impossible to get in. Then, when he did, they told him he couldn’t have done any harm. He thinks he could have shut down all the power to most of an American state.
Fortunately, Lunsford works for IBM’s Internet Security Systems and he was taking part in a controlled experiment.
But the lesson is clear: much of our privately owned but publicly critical infrastructure is highly vulnerable to attack.
SCADA systems monitor flows of fluid or power, open and close valves, and trigger alarms when things go wrong. Whoever controls these controllers controls the system. They are simple devices, typically transmitting and receiving data at slow speeds.
Randy Sutton of Ottawa’s Elytra Enterprises has been trying for years to get government’s attention about SCADA vulnerabilities. He says that until about five years ago, most SCADA systems were at least nominally under human control. They are, however, increasingly being attached to computer networks.
“The operational system is now connected to the corporate network and that’s where the trouble starts,” he says.
There is a basic philosophical difference between a SCADA engineer and an IT security specialist, Sutton points out. Both groups are concerned about the CIAs of security, confidentiality, integrity and availability, but with a different emphasis.
“In the IT security business, we get all worked up about confidentiality and integrity, but reliability and availability, well, while it’s important, it tends to get lost in the shuffle.
“SCADA people are just the opposite. They don’t care about the confidentiality of some little device that’s putting out data at 9600 bits a second. What they care about is 100 per cent availability because if the grid goes down, there’s no point maintaining your confidentiality,” he says.
Sutton makes it clear that hacking into a SCADA system is not particularly easy, but then it might not have to be. “Certainly, if you had some insider assistance, it could become extremely dangerous.”
He points out that IT security is often only as good as the physical and personnel security around it. A classic case of insider sabotage took place in Australia in 2000, when a hacker used wireless equipment to cause the release of some raw sewage.
So far, there are remarkably few such stories and they are endlessly recycled – the successful 2001 hack attack at a California power plant, the nuclear safety monitoring system crippled by the Slammer worm in 2003 – but many in IT security believe incidents have gone unreported and there is even some suspicion that utilities have paid ransoms to halt or prevent attacks.
SCADA security is probably years behind the rest of IT security, Sutton believes, but existing programs could quickly be ported over to plug the gaps. In the electricity sector, the North American Electric Reliability Council has published standards for SCADA security that any big utility tying into the continental grid will have to meet by 2010.
Where governments have regulatory powers, such as in energy or transportation, SCADA systems will inevitably come under some form of mandatory IT security. It will probably take successful attacks, and lots of sensational journalism about those attacks, to bring the rest.
Richard Bray is an Ottawa-based freelance journalist specializing in high technology and security. Contact him at rbray@itworldcanada.com
