Last week, it was revealed that Russian hackers inserted the BlackEnergy Trojan into software that runs much of the United States’ critical infrastructure back in 2011. Here to comment on this news is cyber security expert Philip Lieberman, president of Lieberman Software:
“This is the scenario raised by NIST and NSA for the last 5-plus years with the power industry and those that have responsibility for the critical national infrastructure of the USA. It is very easy for intruders to get a list of weak systems from Showdan using a credit card, then take over the systems using well-known exploits or more powerful and secret zero-day attacks available to governments. In a few hours, you can own the infrastructure of a country.
Featured Download: Social media access at work. Do your employees know the rules?
“Unfortunately, many in the power and infrastructure business have literally zero interest in implementing IT security and consider it to be a nuisance and unproductive expense. The prevalent attitude is that the utility employees should be able to get to anything and everything with no controls and accountability so that they can manage systems in real time with no delays or inhibitors.
“In many cases, systems have factory default passwords, passwords that are stored on spreadsheets and openly shared on the company network, or passwords that are stored in easy-to-crack vaults provided by off-shore companies. The net effect is that in many cases these, critical life services are being run by organizations that are trivial targets to exploit by nation states.
“Go forward plan: don’t aggravate nation states and/or fix the security of these systems. The current administration has not implemented strong security requirements for critical systems. My best guess is that someone will need to die as a result of a nation state attack to get the Obama administration to take concrete action to shore up this national problem.
“It would be naïve and foolish to think that other governments would not use the same techniques used to compromise Iran’s nuclear refining capability on US companies and their infrastructure.”
By Philip Lieberman, CEO, Founder, and President, Lieberman Software
Bio: Philip Lieberman, noted cybersecurity expert and founder/president of Lieberman Software, has more than 30 years of experience in the software industry. In addition to his proficiency as a software engineer, Lieberman developed the first products for the privileged identity management space, and continues to introduce new solutions to resolve the security threat of privileged account credentials. He is frequently quoted by industry news organizations as well as mainstream media and has published numerous books and articles.
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.