Cyberspies Hack Power Grid – Those in the Know, Knew!

Last month the press was abuzz with the news that the US electric grid has been hacked by foreign operatives. To anyone who has studied security in the power industry, this isn’t much of a surprise.

Last fall (Aug/Sept 08), I conducted a survey of 200 critical infrastructure operators (the people who actually work in the industry and KNOW what’s what) on what they thought of the safety of our power grid. 60% of them told me that the energy sector was unprepared to stave off a major attack. They also felt that the power grid was the number one target ripe to be exploited (27%). 50% of them told me that our critical infrastructure had already been successfully attacked.

So, if the people in the know, knew, how come we’re still vulnerable? I asked them that question as well. The number one answer: cost. Number two: complacency. No real surprises there; those are the same answers that we used to get from IT departments 15 years ago on why they didn’t have defense in depth technologies set up to protect servers and databases.

The survey respondents also provided the following comments:

• “There hasn’t been a real incident so no one takes it seriously.”
• “Lack of knowledge and understanding.”
• “Inability of decision makers to commit to security upgrades.”
• “No one wants to pay for security.”
• “False sense of security.”
• “Security competes with other priorities for resources.”
• “We, as Americans, believe we are invulnerable to this kind of attack.”

So what do we do now? I know the legislators are lining up to introduce new rules and regulations as soon as possible. Similar to the $700 trillion authorized for the banks just a few months ago, any new legislation is going to be rushed, impulsive and probably ultimately worse than doing nothing at all.

Yes, we need to act. But, IMHO, we need to think first. There is a group of talented and knowledgeable security experts who have been studying this for many years (and almost none of them have been elected to public office). The answers are well known and doable. We just need the will, the political clout, and the expertise to do it properly.

If anyone would like a copy of the survey results, please feel free to email me at elan_winklermcafeecom  (elan_winklermcafeecom)  .

Tags: Compliance, critical infrastructure