5 vulnerabilities that should be in Trump’s cyber review [Slideshow]

Slide1-1.jpg

Photo Credit: NIST

Photo Credit: NIST

Public Infrastructure Vulnerabilities

A draft copy of President Donald Trump’s executive order on cybersecurity leaked to the press in late January. While the White House has denied the order came from the administration, it would require several cyber reviews the president promised on the campaign trail to undertake once in office.

One such review calls for a holistic report on U.S. vulnerabilities in cyberspace.

What areas might we expect to see listed when these vulnerabilities are reported? The following five targets face persistent threats from attackers domestic and abroad.

Photo Credit: archie4oz via Wikimedia Commons

Emergency Services: The Target

The 9-1-1 emergency phone service is designated by the Department of Homeland Security (DHS) as one of 16 critical infrastructure sectors. According to the National Emergency Number Association, an estimated 240 million calls are placed to 9-1-1 annually. Approximately 70 percent of calls are made with wireless devices.

Photo Credit: Rd144 via Wikimedia Commons

Emergency Services: The Threat

Over the years, researchers have discovered vulnerabilities within the 9-1-1 service, most of which have been fixed. Yet threats against the service persist. If the 9-1-1 service went down, it would be difficult for people to receive timely response to emergencies by police, fire and medical professionals.

Photo Credit: Ryan Johnson via Flickr

Emergency Services: Example

Last year, security researchers at Israel’s Ben-Gurion University of the Negev’s Cybersecurity Research Center published a paper on the U.S. 9-1-1 service’s vulnerability to distributed denial of service (DDoS) attacks. DDoS attacks use a network of compromised devices to flood a target with traffic – in this case, incoming calls to 9-1-1 from compromised cell phones. The researchers developed a rootkit to block tracking of compromised cell phones and then demonstrated several attacks, which could occur without knowledge by the phone’s owner. The researchers wrote that a network with as few as 6,000 compromised cell phones could be used to take down the 9-1-1 service across North Carolina for days. Just 200,000 compromised cell phones could be used to cause significant disruptions to the 9-1-1 service nationwide.

Photo Credit: Andrew Tryon

Energy Infrastructure: The Target

Energy infrastructure – including power generation, transmission and distribution assets – continues to be an attractive target for attackers who are intent on causing potential widespread disruption and serious economic damage.

Photo Credit: Petr Kratochvil

Energy Infrastructure: The Threat

Many security researchers focus on cybersecurity threats to energy infrastructure, especially as it becomes “smarter” via bidirectional communications and automation. Threats to industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems have also received much attention. Physical threats have received less attention but also exist, especially against distributed assets such as substations that are difficult to secure and monitor.

Photo Credit: U.S. Government

Energy Infrastructure: Example

On July 28, 2012, three activists – including an 83-year-old nun – climbed a hill on the perimeter of the Y-12 National Security Complex in Oak Ridge, Tenn. Using bolt cutters, the three made their way through four layers of chain-link fence protecting the largest store of weapons-grade uranium in the U.S. Once inside the fence where lethal force is utilized, they spray painted “Woe to an Empire of Blood” and splattered human blood on the white side of the facility. The three were discovered hours later and eventually arrested, charged and sentenced. The incident drew attention to physical security at the facility once called the Fort Knox for highly enriched uranium.

In a separate incident that occurred on April 16, 2013, snipers using military-style weapons attacked Metcalf substation in California. The attackers first cut fiber-optic cables and then opened fire on the substation. In all, the snipers damaged 17 transformers in an attack that cost $15 million in repair.

Photo Credit: Regiars via Wikimedia Commons

Urban Infrastructure: The Target

Everything is getting “smarter,” incorporating bidirectional communications and automation. Most have heard of the smart grid and smart cars, but companies now offer everything from smart juicers to smart toothbrushes – complete with Wi-Fi connectivity and a 10-megapixel camera.

And then there’s smart urban infrastructure. Smart infrastructure ranges from smart traffic signals to smart parking meters. But anything that’s smart is also hackable and therefore a potential target.

Photo Credit: Ahmed Rabea via Flickr

Urban Infrastructure: The Threat

The trouble with smart technology is that the very capabilities that make it smart also make it vulnerable. The threat to smart infrastructure stems partially from vulnerabilities in computers, network communications, ICS/SCADA systems and digital components. Attackers could, for instance, wreak havoc on traffic patterns by remotely controlling traffic lights. To deal with these threats, the SysAdmin, Audit, Network and Security (SANS) Institute has developed a miniature-scale smart city to train cybersecurity professionals to protect the smart cities of tomorrow.

Photo Credit: Adrian Pingstone

Urban Infrastructure: Example

Hackers attacked the Washington, D.C., closed-circuit camera network on Jan. 12, just days before millions converged on the city for the presidential inauguration and protests. The ransomware attack affected 70 percent of the city’s cameras that monitor public spaces. The attack made it impossible for affected cameras to record public spaces between Jan. 12 and Jan. 15. A British man and Swedish woman were reportedly arrested in the U.K. in early February in connection to the incident.

Photo Credit: xlibber via Wikimedia Commons

Dams: The Target

Dams may not be the first thing that comes to mind when imagining potential targets for hackers. But dams are one of DHS’s 16 critical infrastructure sectors. The ability to create a spectacle and potential widespread damage make them potential targets to hackers and terrorists.

Photo Credit: U.S. Department of Agriculture

Dams: The Threat

Like distributed energy infrastructure and smart urban infrastructure, dams often use ICS/SCADA systems. ICS/SCADA systems are usually networked to enable remote monitoring and control of components.

Photo Credit: City of Rye, NY

Dams: Example

The Washington Post drew fire late last year after it incorrectly reported that a dam in Vermont had been infiltrated by Russian hackers. Although the incident turned out to be false, the scenario is not unlikely or unprecedented.

In 2013, Iranian hackers with the Revolutionary Guard Corps temporarily took control of a 20-foot dam on Blind Brook near Port Chester, N.Y. The incident seems absurd – except that the same ICS/SCADA systems used for this tiny dam in a sleepy subdivision of New York City are also used to monitor and control much larger dams throughout the U.S.

Photo Credit: Mike Watson Images/Getty Images

Classified/Sensitive Government Data: The Target

While Russia may be embroiled in high-stakes espionage intrigue right now, U.S. classified and sensitive information continue to be of interest to a variety of threat actors – from nation-states and terrorists to leakers and criminals.

Photo Credit: U.S. Army

Classified/Sensitive Government Data: The Threat

Insiders are one of the biggest threats to any organization. Insiders have access to all sorts of sensitive information. Insiders easily bypass layers of security that external hackers must identify and infiltrate. While it could take external hackers months to identify a system hosting sensitive information and then get a password, an insider could achieve the same within minutes. Exfiltration from inside can be difficult to detect.

Photo Credit: Patrick Semansky/AP

Classified/Sensitive Government Data: Example

Edward Snowden is the most famous recent example of the insider threat, but the National Security Agency (NSA) has had more recent examples. Last August, another National Security Agency contractor with Booz Allen Hamilton was arrested and accused of “the biggest theft of U.S. classified information in U.S. history,” according to the Washington Post. Harold T. Martin III, 52, of Glen Burnie, Md., was arrested last year and indicted on Feb. 8 on 20 counts of willful retention of national defense informaiton. Martin is alleged to have taken 50 terabytes of digital data and 75 percent of the tools developed by the NSA’s elite Tailored Access Operations (TAO), which conducts cyber espionage on foreign targets. Like Snowden’s case, the Martin case illustrates the ongoing threat posed by government employees and contractors.