As director of research at the SANS Institute, Alan Paller has a unique window from which to view the U.S. government’s efforts to secure its vast computer networks.
An original member of the National Infrastructure Advisory Council, Paller has had the ear of high-level White House officials.
Paller has also been a reliable critic of the government’s cybersecurity plans, which he says are ineffective and mired in bureaucracy.
Last week, Paller was at it again, joining Eric Byres, Director of Industrial Cyber Security at Symantec to talk about cyberattacks on SCADA (supervisory control and data acquisition) systems that manage the nation’s critical infrastructure.
Ahead of that event, Paller told InfoWorld Senior Editor Paul Roberts that SCADA hacks have already happened and that on the five-year anniversary of the Sept. 11, 2001, terrorist attacks, the U.S. gets an ‘F’ for protecting its computers from hackers, terrorist or otherwise.
InfoWorld: We’ve been hearing about the threat of terrorist cyberattacks for years. Is the threat for real?
Alan Paller: It is a real threat, but it’s an interesting threat. What you have happening today is that terrorists are using cybercrime to get the money to buy the bombs to blow people up. But they’re not using cyberattacks against physical things. There have been two cases that are very secret where SCADA systems that run power plants were taken over, but the crime was about extortion — you know, ‘If you don’t pay us we’re going to do something bad.’ In some cases the guys have proven that they can do damage by running a test denial of service attack, or a test outage.
IW: Conventional wisdom was that SCADA systems are too old and idiosyncratic to be easy targets. What has changed?
AP: The difference is that companies have added Windows systems to replace unknown operating systems, and then connected them to their networks, which are connected to the Internet. GAO did a great report (http://www.infoworld.com/4476) on this back in 2004. Most of the attacks we hear about aren’t aimed at SCADA systems, they’re aimed at corporate networks, but once you’re on the network you can get into these (SCADA) systems.
IW: Why should enterprise IT people care about the security of SCADA systems?
AP: The big shock to us was all the places where control systems are used. NIST [National Institute of Standards and Technology] did a study that found SCADA systems were common in the electric, water, oil and gas, chemical, pharmaceutical, pulp and paper, food and beverage, discrete manufacturing, durable goods, air and rail transportation, mining and metallurgy industries. So tell me what’s not covered there. Almost anyone who works in a major industry has this stuff on their plate.
IW: Is there any evidence that foreign governments are privy to information on how to attack SCADA systems in the U.S.?
AP: Well, you have the statement Gen. Lord gave that the military has lost terabytes of sensitive information to the Chinese government. [Editor’s Note: Maj. Gen. William Lord told GCN in August that “China has downloaded 10 to 20TB of data from NIPRNet, the DoD’s Non-Classified IP Router Network.”] That was the first public “oops” that we’ve heard. It was an admission at the highest level that we’ve spent all this money and systematically the Chinese have been able to come in and steal this information.
IW: Recently, an article in Foreign Affairs criticized the U.S. government for playing defense on cybersecurity and missing the way terrorists are using the Internet to organize and raise money. Is that fair?
AP: You’re giving [the government] too much credit for having an active defense. They don’t have an active defense. What they have is a lot of reports that have been written. Just one consulting firm increased their staff writing (cybersecurity) reports from four people to 200 in the last five years. As one chief of staff told me, the best thing to do with those reports is to pile them in front of our buildings so the terrorists can’t use a car bomb to get us.
IW: If you had to give the U.S. government a grade on cybersecurity, what would it be?
AP: It would have to be an F. I mean, if you can’t secure the boxes that you have, that would have to be an F.