Attacks/Breaches

1/28/2010
09:39 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Global Critical Infrastructure Networks Regularly Under Attack

New report from the Center for Strategic and International Studies finds it's not a matter of when energy, telecom, and other networks will be attacked -- but how often

Critical infrastructures worldwide -- everything from oil and gas, electrical, and telecommunications -- are under constant attack, and mainly from foreign nation-states, according to a new report published today by The Center for Strategic and International Studies and commissioned by McAfee.

The report, based on surveys of 600 IT and security executives from these firms worldwide, says these highly sensitive networks are being hit by distributed denial-of-service (DDoS) attacks, malware, and targeted attacks, including advanced persistent threat-style ones. Among the findings: The cost of downtime incurred from an attack is more than $6 million a day, and up to $8 million a day for the oil and gas industries. More than one-third of the execs in all sectors say the threat is growing, and two-fifths expect a major attack in their industry within the next year.

Oil and gas executives suffered the highest rate of stealthy targeted attacks, with 71 percent. Around 54 percent of all respondents had suffered these types of attacks, and more than one-third say they experience multiple infiltrations each month. The findings from the CSIS-McAfee "In the Crossfire: Critical Infrastructure in the Age of Cyberwar" report come in the wake of revelations that the oil industry, including Marathon Oil, ExxonMobil, and ConocoPhillips, reportedly were hit with a wave of targeted attacks in 2008.

Around 54 percent of the respondents say their companies had been hit by a "large-scale denial of service attacks by high level adversary like organized crime, terrorists or nation-state (e.g. like in Estonia and Georgia)," according to the report. And more than half of the respondents had experienced a targeted, stealthy attack akin to the attacks Google, Adobe, and nearly 30 other companies suffered recently.

Nearly 60 percent say critical infrastructures in their countries had been targeted by "representatives" of foreign governments.

The report demonstrates that the actual attacks on critical infrastructure networks worldwide "is as bad as we thought," says Phyllis Schneck, vice president and director of threat intelligence for the Americas at McAfee. "A big takeaway here is this is a giant step toward global engagement on critical infrastructure protection ... helping us incentivize and motivate the private sector to protect these networks."

Nearly 90 percent of the respondents' networks had been infected with malware attacks, and more than 70 percent had suffered low-level DDoS attacks and vandalism, insider threats, leakage of sensitive data, and phishing or pharming.

SQL injection and DNS poisoning attacks had occurred at 57 percent of the organizations, and half of them say these types of attacks happen on a monthly basis.

Execs worldwide aren't exactly confident of their ability to protect their networks in the future, either: Only 20 percent say their industry sector is safe from a serious attack during the next five years, and one-third say their industry sector isn't prepared to handle major attacks or APTs. Among the 80 percent of execs who work on SCADA or industrial control systems and say their networks are connected to the Internet or another IP network, more than half say this generates an "unresolved security issue."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Election Websites, Back-End Systems Most at Risk of Cyberattack in Midterms
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/14/2018
Intel Reveals New Spectre-Like Vulnerability
Curtis Franklin Jr., Senior Editor at Dark Reading,  8/15/2018
Australian Teen Hacked Apple Network
Dark Reading Staff 8/17/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-15504
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. The server mishandles some HTTP request fields associated with time, which results in a NULL pointer dereference, as demonstrated by If-Modified-Since or If-Unmodified-Since with a month greater than 11.
CVE-2018-15505
PUBLISHED: 2018-08-18
An issue was discovered in Embedthis GoAhead before 4.0.1 and Appweb before 7.0.2. An HTTP POST request with a specially crafted "Host" header field may cause a NULL pointer dereference and thus cause a denial of service, as demonstrated by the lack of a trailing ']' character in an IPv6 a...
CVE-2018-15492
PUBLISHED: 2018-08-18
A vulnerability in the lservnt.exe component of Sentinel License Manager version 8.5.3.35 (fixed in 8.5.3.2403) causes UDP amplification.
CVE-2018-15494
PUBLISHED: 2018-08-18
In Dojo Toolkit before 1.14, there is unescaped string injection in dojox/Grid/DataGrid.
CVE-2018-15495
PUBLISHED: 2018-08-18
/filemanager/upload.php in Responsive FileManager before 9.13.3 allows Directory Traversal and SSRF because the url parameter is used directly in a curl_exec call, as demonstrated by a file:///etc/passwd value.