Stopping Hacks from Stealing Corporate Secrets or Disrupting Electric Service

Utilities are stepping up their efforts to protect critical infrastructure now that the U.S. Department of Homeland Security has issued public warnings. The grid’s safety is especially vital, because it transports the lifeblood that fuels the American economy.

Terroristic threats have been pervasive since 9/11. And since that time, utilities have acted to not just protect themselves from physical assaults but also from cyber attacks that seek to spread viruses to disrupt systems. News reports are routinely appearing, which illustrate that foreign nation’s are either trying to steal trade secrets or to sabotage company-wide computer linkages. China, for example, may typify the former threat while Iran would characterize the latter. 

The coverage is coming at a time when U.S. nuclear energy companies are providing regulators with the moves that they are making to safeguard their “critical digital assets.” In fact, a cyber division with the Homeland Security agency says that outsiders are targeting nuclear power plants specifically and that such attacks have risen more 40 percent in recent years, says Booz Allen, a consultancy and public relations firm. 

Outsiders are infiltrating those computer systems through unsuspecting workers, says David Cronin, principal of power generation for the firm. Malware and spyware, for instance, are invading control systems when employees download infected items and when they bring in corrupted mobil devices, connecting them to the company’s network. The best line of defense, says Cronin, is to install firewalls, apply patches and to always perform upgrades. 

“The Nuclear Regulatory Commission wants plants to establish a monitoring station,” says Cronin, in a phone conversation with this reporter. “If I apply patches, I have to sanitize everything I have brought into a plant prior to being on the facility’s floor.” 

Basically, the regulatory agency will audit utilities to determine if they have listed their critical digital assets and to assess how well they are protecting themselves from potential disruptions. If a company’s security has been breached, it must be immediately and fully remediated, says Cronin. Such invasions can range from mere nuisances to the forced closure of power plants. That could cost $1 million a day and potentially punitive fines levied by regulators. 

National Priority 

Most cyber attacks are going unnoticed because they are only affecting a small number of companies that must deal with the fallout. But now that they are becoming more prevalent, stopping them has become a national priority. 

Stuxnet, used by the Americans and Israelis to slow the Iranians’ nuclear aspirations, is a case in which governments have used those tools to go after their adversaries. But criminals using similar techniques to steal valuable information or to bring commerce to a standstill is another matter.

“The right questions that an executive needs to be asking are what is being done to lock down the critical assets and what is being done to lock down the control system environment,” says Pamela Warren, McAfee’s cybercrime strategist, in an earlier telephone interview. 

Jay Cappy, who is with Verizon Business, adds that the goal is to sustain the data’s confidentiality, integrity and availability. That information must be encrypted and the technology must be installed to detect any modifications to that proprietary data, he has written in Energy Central. 

Beyond what the NRC is doing, the North American Electric Reliability Corp. is making similar rules for all electric utilities. According to the Government Accountability Office, the nation's wires infrastructure is comprised of $1 trillion in assets that entail 200,000 miles of transmission lines. Altogether, over 800,000 megawatts of power serve more than 300 million people. Because the system is now connected to the outside world, it is open to attack. ??

“The cyber threat to critical infrastructure continues to grow and represents one of the most serious national security challenges we must confront,” says President Obama, in an executive order. Defending attacks, he adds, can be accomplished “through a partnership with the owners and operators of critical infrastructure to improve cybersecurity information sharing and collaboratively develop and implement risk-based standards.”

Cyber attacks are occurring more frequently and worms and viruses are placing the utility sector at increasing danger. The chief risk is that of massive disruptions to electrical system and to the economy as a whole. But the federal government recognizes such hazards and it is working with companies to prevent them.

To subscribe or visit go to:  http://www.riskcenter.com

http://riskcenter.com/articles/story/view_story?story=99915363