|
By
Ken M. Shaurette
CISA, CISSP
VP ISSA - Milwaukee Chapter,
InfraGard Delegate for Western Wisconsin Chapter
TWith the images of Sept. 11, 2001, still fresh in our minds,
we begin to look for ways to get back to a semblance of
normal. Truth is, nothing about our lives and the way we
conduct usiness will ever be normal again. If we go to work
in a high-rise structure, for a long time we will have vivid
images come to mind whenever we hear a plane go by. When
we board a plane we will wonder if the security will be
adequate to prevent it from being hijacked.
What will be next and how should we be reacting? Don't forget
the images and simply go back to normal. The lives of the
people on the
planes and in the financial district of New York City and
at the Pentagon should not be forgotten. Don't let our critical
information
infrastructures become the next target for terrorism. Our
country possesses both the world's strongest military and
its largest
national economy. Those are but two aspects of our power,
which are mutually reinforcing and dependent on each other.
They are also
increasingly reliant upon certain critical infrastructures
and upon cyber-based information systems.
It is true that it will not be possible to hijack a plane
and crash it into our networks, but can you consider the
potential equivalent?
Is your company taking its critical information infrastructure
for granted, kind of getting into the mode of "It can't
happen here"? We may let ourselves believe that lives
would not be lost if our information infrastructures were
attacked, but is that really the case.
Think about it for a minute. The Internet has created a
global network where anyone can get anywhere at any time.
There is no day or night, since the sun is always shining
somewhere on the Internet.
Companies do not even necessarily need to be Internet connected
to be vulnerable, what about modems, or information shared
over public
communications or simple internal system of a company connected
across the country. Can you honestly trust everyone you
work with your life and your career? Is every one of them
happy with their job?
Would any of them be interested in making large sums of
money given the right circumstances?
How does this relate to our critical infrastructures? It
only takes one vulnerable, inadequately-secured system in
your internal network to provide a person the opportunity
to inappropriately access other parts of your network. The
same is true for home systems or business systems connected
to the Internet to provide a launching pad for attack on
other connected systems. Do you honestly know what your
computers' free processing cycles are doing when you are
not there?
Every company must take a multiple phased approach to warding
off terrorist attacks.
Planning is an important first measure. Sure you
can discontinue flying to avoid being hijacked, but are
you taking similar precautions with your home computer system?
Do you leave it
powered off so that it cannot be taken over? Can a business
afford to do the same with their systems? Hardly seems reasonable
to expect
this any more than you should be expected to never fly again.
Without an appropriate plan for security, companies and
individuals don't even know whether they need more technology
or simply improved administrative procedures. Maybe you
are thinking, "But flying, I could crash and there
would be loss of life!" Do you really believe that
if critical information infrastructures are compromised
there
will be no loss of life?
Let's evaluate a potential scenario: Your system and your
neighbor's system are both left vulnerable. Maybe a few
other neighbors you don't even know do so as well. These
systems are infiltrated with a small program that can harness
the extra processing cycles to attack
other systems in a very targeted fashion.
Electric
and other utilities are continually increasing their already
substantial
dependence on cyber systems. Let's say for illustration
sake that these vulnerable systems are targeted to interrupt
or interfere with 911 services, maybe not in just one place,
but in a coordinated fashion across the country. What about
changing street light signals all to green at rush hour
or maybe attacking a critical power grid, not taking it
down, but causing an overload or surges in power.
Surges can be very harmful to sensitive equipment such as
medical equipment. Are we prepared to trust that all the
backup systems will work, that these few examples are just
wild sensationalism, they couldn't really happen? Well to
be honest with you if someone had
told me before Sept. 11 that one commercial jetliner, let
alone four, would be used like missiles and attack the places
they did, I'm sure
many of us would have said they were crazy, that kind of
thing only happens in the movies.
Critical infrastructures are those physical and information-based
systems essential to the minimum operations of the economy
and
government. They include, but are not limited to, telecommunications,
energy, banking and finance, transportation, water systems
and
emergency services, both governmental and private. In the
"olden days" our nation's critical infrastructures
were physically and logically separate systems that had
little interdependence. Advances in information technology
and the necessity of improved efficiency have resulted in
these infrastructures becoming increasingly automated and
interlinked.
Legislation has begun to be enacted such as HIPAA (Health
Insurance Portability and Accountability Act - http://aspe.os.dhhs.gov/admnsimp/)
or G.L.B (Gramm, Leach, Bliley - http://www.senate.gov/~banking/conf/).
Some could argue that enacting legislation to protect privacy
can have the reverse effect or is infringing on our civil
liberties. Unfortunately the legislation is doing little
more than requiring common sense in requiring actions to
be taken that companies and/or individuals should be already
putting
in place. Too often people are unwilling to self impose
common sense controls just as they would not control their
speeds when it is
prudent to do so without a speed limit. This author believes
these laws are appropriate and more are necessary and also
will soon be
coming. In this author's opinion the Government has already
been dragging their feet on the final security regulations
for HIPAA, but I think the recent events will change that.
In Feb. 2000, President Clinton said "we have to do
more to protect privacy and civil liberties," "We're
here to work together," he said.
Security vulnerabilities could shake users' confidence and
impact the growth of
e-commerce, and goals toward administrative simplification.
For example, by 2007 the IRS hopes to have 80 percent of
tax returns filed electronically. The administration must
balance its responsibility to protect the national security
without encroaching on private business where it has no
authority. In the wake of Sept. 11th's disaster many including
our congressional leaders will be quick to offer up funding
for the military, which is good, but don't forget the "non-physical"
components of our nations security and safety. It is like
building the most secure computer room possible and connecting
it the outside with an unsecured network, we need to
protect our borders, but not just from physical threats
also from virtual threats.
The government needs more resources so it can become a model
for computer security, while private industry must lead
the effort to establish security standards and make sure
that the newest technology to curb attacks is widely publicized
and available, said Harris Miller, president of the Information
Technology Association of America, an industry group.
"The goal is to bring everybody doing business on the
Internet to see that information security is needed, and
to make it simple, that security is good personal hygiene,"
Miller said.
The future is going to be about unifying of our country,
our businesses and heading off "cyber attacks",
attacks against not just our critical infrastructures, but
also our very way of living.
We need to begin sharing information about incidents even
reasonably minor situations. One minor event may not be
a big deal, but correlated with numerous other "minor"
situations it may signal a trend of something bigger. There
must be multiple phases to the
approach. We must rally behind our leaders and support actions
to prevent the recent kind of attack from occurring again.
The Government, as well as each company and individual needs
to unify. Of course financing for the work that is already
in progress, supporting agencies and organizations such
as InfraGard or the National
Infrastructure Protection Center (NIPC) www.infragard.net,
www.nipc.org). Providing support or assistance in the establishment
of acceptable practices for improving security such as the
CASPR project (www.caspr.org) are ways each of us can get
involved. Working
together we need to share information about incidents and
unusual activity with our systems and networks. An organization
such as
InfraGard can provide the coordination mechanism and with
proper funding to help instill confidence in the concept
to potential member
organizations, templates and guidelines can be created so
that we know what to look for, we can freely participate
and share, without
fear of compromise or having the information used against
us.
Good ways to participate in improving the security for our
critical infrastructures is to at least share information
about vulnerabilities, share personnel who can provide their
experiences, share solutions that were successful and that
others could use. Don't
be afraid of a little "co-opetition" (cooperation
and competition), competing yet cooperating with your other
companies and your fellow
workers.
Protecting our nation's critical infrastructures starts
with each of us, companies as well as individuals. We are
more unified in many ways than every before because of the
events of Sept.11, 2001. Don't let the destruction and loss
of life from this tragedy be forgotten, don't let it happen
again. Everyone can help by using good security practices
at your home or business and in teaching and practicing
the legal and ethical use of computers and the Internet.
Unify, unify,
unifyŠ. Working together we can accomplish the things
that we as individuals might not otherwise be able to.
|
