Cyber Attacks, Energy Security and Spearfishing
It been reported that sometime in March, the U.S. Department of Homeland Security began issuing "amber" alerts that warned of a cyber-intrusion campaign aimed at the natural gas pipeline companies. The alerts were reinforced in a report from an arm of DHS, the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) to pipeline companies and power companies. ICS-CERT is charged with helping secure the nation's industrial control systems – IT systems that manage the valves, switches and automation processes critical to the chemical, industrial, and power industries. A number of natural gas pipelines have reported either attempts or intrusions related to a campaign which appears to have started in late December, 2011, and is still active.
It not hard to guess why pipeline safety is a major concern. Approximately 200,000 miles of the interstate natural gas transmission pipelines in the US supply 25% of our energy. Safeguarding the control systems from cyber-attack is a major issue in Congress, wrestling with whether to give authority to the feds to make sure the electric utility, oil and gas, and chemical industries meet certain levels of cyber security.
The threat of cyber-weapons and cyber-war could still seem abstract, even for technology CEOs. It became quite real at a classified security briefing in Spring 2010. The briefing on cyber-threats came at a secret session hosted by the Director of National Intelligence, the departments of Defense and Homeland Security and the head of the U.S. military's Cyber Command. Officials warned that due to a design flaw, "we can turn your computer into a brick." The meeting was part of the "Enduring Security Framework," a public-private partnership that brings CEOs from top technology and defense companies to Washington for classified briefings. The purpose is to share information about developments in cyber-warfare, highlighting the cyber-weapons that could be used against the CEOs' own companies.
So how does an attack get started? The ICS-CERT report described a pretty sophisticated "spear phishing" campaign, where attackers work to establish digital footholds inside corporate networks. Spear phishing has become an attack of choice for infiltrating corporate networks. In an attack, a specific person in the organization is researched, often using social networking sites like Facebook or LinkedIn to craft innocent looking e-mails that appear to be from a close associate.
It’s awfully serious and pretty scary. This got me thinking about my own use of social media, specifically LinkedIn for my business connections. Like many, I use social media to research my way to new business relationships. It’s a very real example of social media’s conflicted relationship - not just with personal privacy but with cyber security, too. However, for the record, I am not now nor have I ever knowingly been a cyber-threat!
Posted by JeffBrown, Vice President on 04 June 2012
Comments (0)