Dick Cheney, Your Water Meter and Cyber War in Western Ukraine
In 2013 Dick Cheney revealed that doctors had disabled a wireless transmitter in his pacemaker implant. The transmitter enabled doctors to remotely manage his condition. But Mr. Cheney and his doctors were concerned his pace maker could be the target of a hack, allowing an attacker to remotely induce heart failure. So they turned off it's ability to connect with wireless networks. Smart move.
Unfortunately for managers of major civil infrastructure such as dams, pipelines or energy grids, the decision to just turn off the transmitters on their control system devices isn't an option. There are often hundreds of these wireless devices in a single facility providing vital information and control capability required to keep services running safely. To completely remove the risk of these devices being hacked would take a full redesign of how these plants operate.
And while government and other managing organisations have been falling behind in terms of managing the cyber risks around their wireless control systems, hackers have been busy working out how to take advantage. Late last year a cyber attack crippled a power grid serving 80,000 homes in Western Ukraine. Luckily the temperature in Ukraine at the time was unseasonably warm and the outage led to zero fatalities. Had the temperature been closer to the historic average, which is well below freezing, there might have been legitimate risk to life.
The theoretical ability to hack and bring down a major civil service has been around for a while. And the discovery in 2010 of the STUXNET virus, which seriously damaged an Iranian uranium enrichment facility, moved the goal posts from theory to practice. Two years later the energy industry received another unpleasant surprise when Saudi Arabia's state oil company, Saudi Aramco, had 35,000 of its computers rendered useless by a cyber attack, halting supply of 10% of the world's oil supply and forcing employees to use typewriters and fax machines to continue conducting business.
But the STUXNET virus and the attack on Saudi Aramco are both presumed to be bespoke, state-sponsored creations, very advanced and highly tailored for their respective targets. By way of contrast, there is early evidence that certain layers of the code used in the 2015 Ukraine attack are highly modular. This is an indication that the code for this new attack is part of a tool kit that can be easily distributed and modified.
In October of last year US Department of Homeland Security officials warned a conference of American energy companies that attacks on infrastructure from groups such as ISIS as well as domestic terrorist and hate groups were increasing in both frequency and sophistication. They also warned that as more sophisticated code becomes available on the black market, these attacks will begin to succeed.
The miracle of the digital age also its biggest risk. Any data set or code base can easily be copied and shared. As I write, dozens of hacker communities, altruistic and malicious alike, are trying to get their hands on the code used to disable the Ukrainian power station. Both sides will get it. And copies of that code will proliferate. The good guys are trying to analyse and understand the new threat so they can develop ways to defend against it. The bad guys, however, will analse it and modify it to be even more effective at getting around the good guys.
Defending an organisation against this constantly evolving attack landscape is incredibly difficult. It requires a mix of excellent technology, awareness of how hacker capability is evolving and a holistic approach to engaging staff and developing an organisational culture focused on cyber defense. Not many organisations are very good at it, least of all local government agencies.
The Financial Times has reported on results of a survey of global nuclear power plant operators conducted by think tank Chatham-House. Chatham-House analysts concluded that the results showed a pervasive "culture of denial" across the nuclear industry when it came to susceptibility to cyber attack. Having focused for so long and very successfully on physical security, these organisations were struggling to adapt their processes and procedures to the fast-evolving world of cyber threats. No doubt a survey of organisations managing other critical civil infrastructure would yield similar results.
As private citizens reliant on these services we each need to give serious thought as to how we can manage through and recover from the occasional shut down of core local civil services. Preparing for a disruption in civil services isn't new. Whether it's an earthquake readiness kit for Los Angeles basin residents or stocking sand bags in case of a failed levy for the residents of York in the UK, there are simple steps to take to be better prepared for interuptions in core services. It's just that with a growing, credible cyber threat to these services, those interruptions are likely to be more frequent and without warning.
I started thinking through my own contingency plans seriously in 2011 in the aftermath of the London riots. Having moved to the heart of London only 2 weeks earlier, I remember being up before dawn watching the local news footage of cars burning in our neighborhood. Needless to say, normal transportation services were not available. Thankfully, we survived unscathed from those difficult weeks in London. But I determined to be better prepared for another breakdown in basic services, transportation or otherwise.
Soon after, I wrote a series of blog posts detailing my thought process and preparations. Not only do the posts detail the simple steps we took as a family to prepare for another community-wide disruption, but it offers links to other ideas and resources all aimed at preparing for a break down of the same civil services that underpin daily city life. With the evolution and proliferation of malicious code, there is a new challenge to those services remaining in steady, continuous operation as we have become accustommed to.
And with the shut down in Ukraine, we can no longer honestly say we didn't have any warning.
Comments