Security experts are divided over the best way to address cyber threats to critical national infrastructures--the computer systems that control essential services such as gas, water, and electricity.
At the RSA Conference in San Francisco on Tuesday, U.S. homeland security secretary Michael Chertoff said it was a certainty that such infrastructures faced increased threats from hackers. Some security experts have responded by claiming cryptography is sufficient in securing the networks in question, but others have suggested the networks are not impenetrable.
"Cyber attacks are not a theoretical possibility or even a remote probability--it's a no-brainer that there is [increased threat]", said Chertoff. His words echoed those of the president of the Institute for Defense Analysis, retired general Larry D Welch, who told ZDNet Asia sister site ZDNet UK at the Cyber Warfare Conference 2008 in London last week that the threat to military and critical national infrastructure networks from terrorist or government incursions was "very serious".
"We've seen probing of aircraft control systems, probing of electrical grids," said Welch. "You can't say when or what will happen, but the potential consequences make it a very serious threat. Shutting down the infrastructure at the right time can be devastating--shutting down the natural gas infrastructure in the northern states in winter, or shutting down the traffic-light system in a city in rush hour, [for example]. Threats to banking and finance could cause substantial losses."
Also at the Cyber Warfare Conference last week, a senior figure in the U.S. Air Force told ZDNet UK that the United States needed to create great cyberattack capabilities of its own, rather than relying on network defense. However, at this week's RSA Conference, Sun's chief security officer Whitfield Diffie questioned that idea, arguing that cryptographic network defense was working.
"We have had remarkable success in cryptography," said Diffie at a forum session at the conference in San Francisco. "The security of cryptographic systems seems, as a practical matter, to have been resolved. On the other hand, Internet security is a complete mess.
Bruce Schneier, chief security technology officer for BT, agreed that securing the Internet was a more major problem than the security of cryptographic systems, but said cryptographic systems themselves could still be undermined.
"We really can't rely on crypto systems," Schneier told ZDNet UK. "War is historically waged in every theater--land, sea, air--and that now includes cyberspace. War happens everywhere, and war will now have a cyberspace component." Schneier questioned the capabilities of cyber-terrorists to shut down critical national infrastructure systems, however, as those systems have controls such as manual overrides.
Alan Paller, director of the SANS institute, said at a separate RSA Conference forum that greater data-sharing was required in order to counteract the effects of politically motivated attacks on information systems.
"Our one great failure is information sharing," said Paller. "It's really bad. I was talking to the CEO of a major bank recently, and asked him if the bank shared information with governments. He said he shared information with [the U.K. Center for the Protection of Critical National Infrastructure]. I asked him if he shared the information with U.S. sectors, and he said 'Oh never, never'."
Speaking to ZDNet UK after the forum, Paller said that, while he disliked the term "cyber cold war", countries were developing cyberwarfare capabilities.
"Right now, 25 countries have military cyberwarfare teams," said Paller. "By 'warfare' I mean spying and stealing data--not blasting people yet. And yes, we are giving up more of our privacy [as a result]." Sun's Diffie questioned this loss of privacy, asking: "Are we going to have to surrender everything to Internet policing methods, or can we find systems barrier methods which will give individuals some degree of autonomy and security?"
Welch, however, said threats to critical national infrastructures currently came from terrorists more than countries, saying he did not "see nation states at this point as a high threat".
"In China and Russia the capability exists [to attack critical national infrastructures], but I can't imagine how nation states would be motivated to do that," said Welch, adding: "It's very clear that we've seen lots of probing, so those who could potentially cause harm do understand how our networks operate. All it takes is some motivation served by shutting down the system. My perception is that terrorists have objectives, and they weigh the risks versus the probability of success. If they wanted to create short-term chaos they probably would not be motivated to attack the critical national infrastructure--it would likely be part of an organized concerted attack that shut down multiple networks."
Play video
» Ultimate virtualization blade
There are currently no comments for this post.