Pierluigi Paganini May 24, 2013

US Congressmen Ed Markey and Henry Waxman issued the report “Electric grid vulnerability” on the level of security for US critical infrastructure.

Attack on critical infrastructure is the main concern for worldwide security community, every government has become aware of the risks related to a cyber attack against their own country and is investing to improve its cyber capabilities.

Day after day the number of attacks against critical infrastructure is increasing at an alarming, US is among the most targeted countries, a report issued by U.S. Congressmen Ed Markey and Henry Waxman revealed that  that the quantity of assaults against core infrastructure continues to rise.

The report, titled “Electric grid vulnerability” report, states that a utility facing roughly 10,000 attacks every month, the study is based on 160 surveyed U.S. utilities.

The most concerning aspect is that around 10 % of US critical infrastructure are daily under attack of various types, such as malware based or spear-phishing attacks.

The report highlighted the economic impact of grid vulnerabilities, it is estimated that power outages and related damage cost the U.S. economy between $119 to $188 billion per year and a single successful cyberattack can cause losses upwards of $10 billion.

The Department of Homeland Security demonstrated that 2012 registered an increase of 68 percent in comparison to 2011 for the number of cyberattacks against US critical infrastructure, industrial bodies and Federal offices.

Every day there are numerous attacks conducted to discover vulnerabilities within these critical systems, many of these attacks is perpetrated in an automatic and method manner.

A Midwestern power provider declared that it was “subject to ongoing malicious cyber and physical activity. For example, we see probes on our network to look for vulnerabilities in our systems and applications on a daily basis. Much of this activity is automated and dynamic in nature – able to adapt to what is discovered during its probing process.”

To respond the increasing threat of cyber-attack security community has called on Congress to provide a federal authority with the necessary power to ensure the grid protection from potential cyber-attacks, but despite these calls for action since now Congress has not provided any governmental entity with the necessary capabilities.

Today the protection of  the nation’s electricity grid from cyber-attack is referenced “by voluntary actions recommended by the North American Electric Reliability Corporation (NERC), an industry organization, combined with mandatory reliability standards that are developed through NERC’s protracted, consensus-based process. Additionally, an electric utility “

“Almost all utilities surveyed are compliant with mandatory NERC standards but totally ignore recommendations by NERC. The report provided disturbing data, for example despite NERC has established both mandatory standards and voluntary measures to protect against Stuxnet warm, the implementation of voluntary countermeasures was overruled.”

Stuxnet voluntary measures have been implemented by only 21% of IOUs, 44% of municipally– or cooperatively owned utilities, and 62.5% of federal entities reported compliance, an alarming data in my opinion.

The cybercrime is considered the most dangerous threat for US critical infrastructure that are under unceasing cyber attacks, its menace is more concerning of terrorism, because the increasing sophistication level of the attacks.

Fortunately despite the delay in the adoption of proper countermeasures for many US critical infrastructures hasn’t yet caused a successful breach of their systems.

As usual there are different opinions, some say the report provides a false overview on real security of national critical infrastructure that are protected from external cyber attacks thanks the compliant of mandatory standards set by the NERC.

“The majority of those attacks, while large in number, are the same attacks that every business receives” through web-connected networks,” “Those are very routine kinds of attacks and we know very well how to protect against those…Our control systems are not vulnerable to attack,” Arkansas Electric Cooperative Corporation Chief Executive Duane Highley told Reuters.

It is my opinion that whatever the actual state of infrastructure is necessary that all measures are taken to ensure  protection from the attacks of increasing complexity.

Pierluigi Paganini

(Security Affairs – Cyber Security, US critical infrastructure)