Last fall (Aug/Sept 08), I conducted a survey of 200 critical infrastructure operators (the people who actually work in the industry and KNOW what’s what) on what they thought of the safety of our power grid. 60% of them told me that the energy sector was unprepared to stave off a major attack. They also felt that the power grid was the number one target ripe to be exploited (27%). 50% of them told me that our critical infrastructure had already been successfully attacked.

So, if the people in the know, knew, how come we’re still vulnerable? I asked them that question as well. The number one answer: cost. Number two: complacency. No real surprises there; those are the same answers that we used to get from IT departments 15 years ago on why they didn’t have defense in depth technologies set up to protect servers and databases.

The survey respondents also provided the following comments:

• “There hasn’t been a real incident so no one takes it seriously.”
• “Lack of knowledge and understanding.”
• “Inability of decision makers to commit to security upgrades.”
• “No one wants to pay for security.”
• “False sense of security.”
• “Security competes with other priorities for resources.”
• “We, as Americans, believe we are invulnerable to this kind of attack.”

So what do we do now? I know the legislators are lining up to introduce new rules and regulations as soon as possible. Similar to the $700 trillion authorized for the banks just a few months ago, any new legislation is going to be rushed, impulsive and probably ultimately worse than doing nothing at all.

Yes, we need to act. But, IMHO, we need to think first. There is a group of talented and knowledgeable security experts who have been studying this for many years (and almost none of them have been elected to public office). The answers are well known and doable. We just need the will, the political clout, and the expertise to do it properly.

If anyone would like a copy of the survey results, please feel free to email me at elan_winkler@mcafee.com.

This morning I heard news reports that the south bay had a telecommunications fiber cut, but my friend Bob from Gilroy had texted me using his phone saying that the local Gilroy PD said it was some sort of fire that caused the outtage. Then this afternoon, I overheard some folks saying there was some sort of vandalism by ex employees of the utility company…. wow, ever changing story. So while thinking about what I should write for the blog today, I quickly searched for an article on this communications outtage and came up with this:

http://cbs5.com/local/phone.internet.outage.2.980578.html

While I realize this is a physical outtage, I just wanted to remind everyone how much we rely on these systems to be around and the trouble it causes when they go away. Apparently calls for even 911 services were not functioning.

“With residents unable to call 911, Santa Clara County spokeswoman Joy Alexiou said people with emergencies should go to a nearby hospital, firehouse or police station. The county had people at those locations with communications radios and the Sheriff’s Department doubled patrols.”

I would like to contend that an electronic “doomsday” would look quite similar to the communications outtage in the south bay today if someone were to arm Conficker with a new payload to take out our critical infrastructure, with the exception of possibly even effecting the power grid. With the recent reports of possible espionage with our power grid it certainly worries me as a citizen.

It’s a scary story reminiscent of the cold war era that sounds like it comes right out of a science fiction novel: Spies linked to Russia and China penetrated the U.S. electrical grid.

The cyberspies have left behind software programs that could be used to disrupt the system, according a report Wednesday on the front page of The Wall Street Journal. The intruders haven’t sought to damage the power grid or other key infrastructure, but officials warned they could try during a crisis or war, according to the Journal report.

Unfortunately this isn’t science fiction or Hollywood– it is real, The publication of this story will hopefully focus attention on the urgency and importance of strong cybersecurity to protect all of our critical infrastructures. We do not have time to debate this any longer. Electricity can be considered the most critical of our critical infrastructure because everything runs on electricity.

I have been tracking attacks on our critical infrastructure for more than a decade. These systems were designed for reliability and availability, and security was not a priority by culture, since many of the intricate electronic systems that run our physical infrastructure were never connected to IP-based systems and the brave new world of vulnerability that IP systems bring.

Critical infrastructures such as energy, telecommunications, finance and water have become more vulnerable to attack because there has long been a focus on expansion, with security added later and literally retrofitted in minimum capacity. We have used IP connectivity to expand availability, reliability, efficiency and even quality through the use of advanced service delivery and remote global monitoring. However, with that connectivity to comes the world of cyber vulnerability and the need for cybersecurity.

As an example, the organizations that run these systems have added means for remote management and monitoring that are now among the security weaknesses.

Breaches in our critical infrastructure have happened several times in the past, intentionally and unintentionally. As part of an experiment to prove the physical consequences of cybercrime, the Department of Homeland Security demonstrated how it could remotely destroy a diesel generator in October 2007.

Unintentionally, a nuclear plant in Ohio has shut down after a contractor logged in with a laptop that had malicious code on it.

These events can be prevented. The security community has created technology that covers everything from the systems, the network and the cloud. Wearing my McAfee hat, this is powered by our unmatched global threat intelligence (imagine protecting every system based on events seen at all systems across the world) to provide a higher level of protection to prevent these types of attacks and help keep the lights on across the U.S. and the world.

But is it safe? Is it secure? What opportunities does the smart grid create for the hacking community? No one really knows, and that’s part of the problem. We’re so turned on by technology and the advantages that it creates for us, that we don’t want to think about the dark side. And, in this case, I mean “dark” side literally. A sophisticated hacker that could get control of these smart devices in our homes could literally black out entire sections of the country. Anyone remember 2003 when a downed tree put out the lights for 55 million customers? That would be child’s play compared to the potential risks from a smart grid hack that could originate from anywhere in the world.

So, let’s be smart, and safe. These devices should be thoroughly tested by security professionals to really understand and uncover the cyber risks. After all, I’m not laying awake at night dreaming of the day that the power in my house is “smart.” Are you?

Now it’s pro-Hamas supporters. Just last week they gained access to an Israeli Domain Registration Server and for several hours, Internet users attempting to visit the Ynet English and Bank Discount Web sites were instead directed to a server in Japan that was hosting a site filled with propaganda.

While I am a strong free speech supporter and believe that every side of a conflict has its own story to tell, let’s not confuse political agendas with cyber crime. Denial of service and Web site hacking attacks are crimes and violate the very intent and purpose of the Internet. If you want to engage in propaganda, do it on your own Web site!