In case you missed the 60 Minute Segment this past weekend, below is a recap of the troubling information presented. The segment highlighted recent cyber attacks and looked at what the US is doing to move cyber security forward. It also included expert commentary from Mike McConnell, former DNI and presently at Booz Allen Hamilton, Jim Lewis of Center for Strategic and International Studies and Shawn Henry of the FBI.
The United States has become increasingly vulnerable to cyber attacks. Jim Lewis believes that, as the most networked nation, the US has the most to lose in cyber attacks. In speaking of cyber attackers, Lewis said “They can disrupt critical infrastructure, wipe data, we know they can rob banks so its a much bigger and serious threat.” He pointed to a series of cyber attacks that have occurred on US government systems, including in 2007, when a hacker broke into the systems of the DoD, Department of State, Department of Commerce, and likely the DOE and NASA as well. The hacker(s) downloaded terabytes of information, equivalent of all the information stored in the Library of Congress being stolen. Additionally, someone also broke into the CENTCOM system and was able to sit on the network reading all communications and traffic. Lewis believes the incident was the result of DoD personnel plugging in infected flash drives that allowed the hackers to gain access to the system. This is an area of concern for government officials, prompting many organizations to ban the use of flash drives or to limit their use. Jim Gosler, a Sandia fellow, said “We have found micro electronics and electronics embedded in applications that shouldn’t be there.” He said this was clearly the work of foreign intelligence services.
In May 2009, when Obama set cyber security as a national priority, he mentioned a high profile attack that occurred against another nation’s power grid. 60 Minutes claims that according to a half dozen sources in the intelligence and defense community, Brazil was the nation that came under attack. In 2005 and 2007, two separate regions of Brazil were hit by alleged cyber attacks that shut down the power grid. However, the Brazilian government and the energy company responsible for the power grid in the areas that suffered power outage deny the claim made by 60 Minutes. They say that the power outage was the result of insulators that did not receive proper maintenance and cleaning.
Mike McConnell said “The United States is not prepared for such an attack.” He is most concerned about the ability of a sophisticated hacker to assault the US power grid and shut off power in adverse weather conditions. McConnell also discussed the possibility of data deletion, a looming fear amongst cyber professionals. “What happens when the attacker is not attempting to steal money but to destroy the process that accounts for money?” he said. The FBI’s assistant director for cyber crimes, Shawn Henry discussed several high profile cases of cyber hackers stealing money from banks, including a recent incident in which criminals stole $10 million in a 24 hour period. “There are thousands of attempted attacks everyday,” Henry said.
Despite these events, many experts believe the United States is not doing enough to adequately secure the critical infrastructure. The vast majority of the nation’s infrastructure is in private hands. DOE officials have demonstrated their ability to hack into power systems and knock it off line. The Aurora Project conducted by DHS demonstrated the ability of remote hackers to gain access to a power system and destroy the generator by causing it to overheat. John Hamre, president and CEO of CSIS, believes that the model for cyber security is not a standard security model. A better way to consider issues in cyber security is to liken the situation to why a doctor is able to work in a hospital and not become sick. McConnell is concerned that with numerous competing priorities, the US will not be galvanized to adequately protect its networks until a catastrophic attack occurs. Hopefully, the Obama administration will implement appropriate security measures for that happens.