October 31, 2011 By Wayne Hanson
Vehicles speed toward a railroad crossing as a train approaches. But the warning lights stay off and the gates remain open. Traffic signals blink out at numerous busy intersections, snarling traffic for miles. Pressure in a residential gas line spikes but sensors fail to warn the utility. A nuclear power plant overheats but the safety systems indicate things are normal.
Such systems — termed Supervisory Control and Data Acquisition (SCADA) — run unnoticed when functioning properly, but a malfunction can mean catastrophe. And now, added to the normal vulnerabilities in any mechanical or electrical system, are some new threats. These systems are now targets of cyberattacks from individual hackers, groups with some social or political agenda — even nations intent on creating havoc.
The threat is not science fiction. In an experiment caught on video and released on the Internet, an electrical power generator is hacked and damaged remotely. According to CNN, the experiment, dubbed “Aurora,” was conducted in 2007 by the U.S. Department of Energy. “DHS acknowledged the experiment involved controlled hacking into a replica of a power plant's control system,” said a CNN article. “Sources familiar with the test said researchers changed the operating cycle of the generator, sending it out of control.”
For more than 10 years hackers have managed to disrupt, damage or stop the operation of critical infrastructure. A report from the Black Hat information security conference outlines some of the better-known incidents. In 2000, hackers gained control of Russia’s Gazprom natural gas pipeline network, and in 2003, a worm attack shut down an Ohio nuclear power plant safety system. And computers seized in Al-Qaeda training camps had data on SCADA systems for dams and other infrastructure.
According to one industry paper, less well-known but more insidious attacks have been occurring for at least five years. Perhaps the most sophisticated attack of all was a Stuxnet worm attack on Iran’s uranium enrichment program, blamed by some on the U.S. and Israel.
In September, the Department of Homeland Security released a bulletin warning of threatened attacks on infrastructure by so-called “hacktivists.”
So what can utilities and local governments do to reduce vulnerability? One common-sense approach is to avoid exposing these systems to the Internet. A tutorial by DPS Telecom says: “For security reasons, SCADA data should be kept on closed LAN/WANs without exposing sensitive data to the open Internet.”
But removing SCADA networks from the Internet might prove expensive. “Using the Internet,” reads another industry report on the subject, “makes it simple to use standard Web browsers for data presentation, thus eliminating the need for proprietary host software. It also eliminates the cost and complexity of long-distance communications.”
As systems become more complex, intelligent and networked, some security problems may be solved while others are created. Larry Karisny, a frequent contributor to Digital Communities on the subject of the smart grid, answered some questions about this arcane but essential subject.
Digital Communities: How does one differentiate between all the different types of industrial control systems?
Karisny: The capabilities between these systems are beginning to blur in functionality as the technical limits that drove the designs of these various systems are no longer as much of an issue. From legacy telephony connections to small embedded controls attached to an industrial computer via a network, we are entering a whole new world in critical infrastructure system design. When you start interconnecting these system design functions you start detecting existing security problems or need to find new ways to secure these needed power-grid upgrades.
Historically weren’t SCADA systems closed and very hard to penetrate? For example, to disrupt the electrical supply in the past, someone would have to attack the physical components?
One of the biggest fears of power grid attacks is physical. When reviewing the components of the power grid, there were potential single-operator catastrophic physical vulnerabilities found in facilities. With a single lock on a door and no way of viewing the operator, video cameras are now put in power grid locations — understanding that