Many, Many Methods Of Cyberattacks
Yesterday CNN ran an interesting story, "U.S. at risk of cyberattacks, experts say."
For those of you in the information security biz this is not new news, I know. We've known and discussed the massive and insidious types of damage that could be done through cyber attacks for several years. However, there is still not enough being done.
"The Web sites of key government security agencies, such as the Pentagon and the Central Intelligence Agency, are difficult to bring down, experts said. So are the computer networks of large American banks. But experts say a successful, large-scale attack on U.S. computer systems could hobble electric-power grids, transportation networks and industrial-supply chains."You'd see some disruption of essential services, like electricity. You'd definitely see espionage," said James A. Lewis, a senior fellow at the Center for Strategic and International Studies in Washington. "Would it be decisive? No. Nobody's going to win a conflict with the United States in cyberspace. But would it be disruptive and irritating? Yes.""
Knowing the lack of security and controls in many of the existing applications and existing systems, I believe it could be much more than just irritating.
A rather different slant that was not discussed was considering our horrible economy along with world unrest...
I'm surprised the article did not talk about the actual types of economic disruption that could be done through cybercrime that could have a huge and devastating impact. Not necessarily from the large cyber attacks discussed in the article, but from changing data, systems and applications code. And if the cybercriminals did it just a little bit here and there, consistently over time, imagine the huge problems it could cause to banks, insurance companies, medical providers, energy companies, communications companies, and so on.
Just a few scenarios that could happen through vulnerable applications code and poor access controls to databases...
- What would happen if the stock prices were lowered by a few cents, or dollars, for some companies or raised for others, by cybercriminals a little bit each day or week over a period of time?
- What would happen if the code in hospital networks were changed so that amounts of automatic drug doses were all changed by a decimal point?
- What would happen if the data was changed slightly for the power grid roll-over points?
- What would happen if the car factory computer systems had the locations for the bolt attachments changed by just a quarter inch to the left or right of the proper location?
We could keep brainstorming this list ad infinitum.
The article focuses on cybercriminals from the outside and the need for firewalls and other perimeter protections; all important.
However there is perhaps even greater risk from insiders, along with poorly engineered and poorly controlled and protected applications and systems. More attention needs to be paid to those before something major happens.
Just some food for thought.

Email This!
Digg it!
Del.icio.us
Reddit!
Newsvine
Comments
This is truly scary. I think most people go about their daily lives and business without a second thought to this very real possibility -- likely hoping and expecting someone else to take care of things. Thanks again for bringing it to our attention so that we can be aware.
Posted by: Caroline | August 19, 2008 10:44 PM
National security and cyberattacks should be a major concern of our government. Although I understand the committment to free enterprise, this is an area that should not just be left to private companies to protect. A huge vulnerability exists in the millions of home computers nationwide. Most do no have firewalls, many have no antivirals or antispyware. Many home computer operators have no idea what these terms even mean, they have a computer at home and just use it. Why else would there be the ability to turn so many home computers into "botnets" for attacks?
It would be very easy for the government to develop public domain antiviral, antispyware, and firewall software that citizens could download for free from a goverment website to install on their computers.
Forgive me Norton, McAfee and all the others, but allowing citizens to take control of protecting themselves from attack for national security purposes, is more important than your corporate profits. You might even be able to get a government contract to help in the public service effort. Cyberattacks on citizens would be just as damaging to our country and morale as attacks on banks and power grids. Our government can help us by giving us the tools and helping us use them to protect ourselves.
Posted by: Anonymous | August 20, 2008 9:32 AM