Attacks/Breaches

1/28/2010
09:39 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Global Critical Infrastructure Networks Regularly Under Attack

New report from the Center for Strategic and International Studies finds it's not a matter of when energy, telecom, and other networks will be attacked -- but how often

Critical infrastructures worldwide -- everything from oil and gas, electrical, and telecommunications -- are under constant attack, and mainly from foreign nation-states, according to a new report published today by The Center for Strategic and International Studies and commissioned by McAfee.

The report, based on surveys of 600 IT and security executives from these firms worldwide, says these highly sensitive networks are being hit by distributed denial-of-service (DDoS) attacks, malware, and targeted attacks, including advanced persistent threat-style ones. Among the findings: The cost of downtime incurred from an attack is more than $6 million a day, and up to $8 million a day for the oil and gas industries. More than one-third of the execs in all sectors say the threat is growing, and two-fifths expect a major attack in their industry within the next year.

Oil and gas executives suffered the highest rate of stealthy targeted attacks, with 71 percent. Around 54 percent of all respondents had suffered these types of attacks, and more than one-third say they experience multiple infiltrations each month. The findings from the CSIS-McAfee "In the Crossfire: Critical Infrastructure in the Age of Cyberwar" report come in the wake of revelations that the oil industry, including Marathon Oil, ExxonMobil, and ConocoPhillips, reportedly were hit with a wave of targeted attacks in 2008.

Around 54 percent of the respondents say their companies had been hit by a "large-scale denial of service attacks by high level adversary like organized crime, terrorists or nation-state (e.g. like in Estonia and Georgia)," according to the report. And more than half of the respondents had experienced a targeted, stealthy attack akin to the attacks Google, Adobe, and nearly 30 other companies suffered recently.

Nearly 60 percent say critical infrastructures in their countries had been targeted by "representatives" of foreign governments.

The report demonstrates that the actual attacks on critical infrastructure networks worldwide "is as bad as we thought," says Phyllis Schneck, vice president and director of threat intelligence for the Americas at McAfee. "A big takeaway here is this is a giant step toward global engagement on critical infrastructure protection ... helping us incentivize and motivate the private sector to protect these networks."

Nearly 90 percent of the respondents' networks had been infected with malware attacks, and more than 70 percent had suffered low-level DDoS attacks and vandalism, insider threats, leakage of sensitive data, and phishing or pharming.

SQL injection and DNS poisoning attacks had occurred at 57 percent of the organizations, and half of them say these types of attacks happen on a monthly basis.

Execs worldwide aren't exactly confident of their ability to protect their networks in the future, either: Only 20 percent say their industry sector is safe from a serious attack during the next five years, and one-third say their industry sector isn't prepared to handle major attacks or APTs. Among the 80 percent of execs who work on SCADA or industrial control systems and say their networks are connected to the Internet or another IP network, more than half say this generates an "unresolved security issue."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-3906
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 contains hardcoded credentials in the WCF service on port 9003. An authenticated remote attacker can use these credentials to access the badge system database and modify its contents.
CVE-2019-3907
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password).
CVE-2019-3908
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 stores backup files as encrypted zip files. The password to the zip is hard-coded and unchangeable. An attacker with access to these backups can decrypt them and obtain sensitive data.
CVE-2019-3909
PUBLISHED: 2019-01-18
Premisys Identicard version 3.1.190 database uses default credentials. Users are unable to change the credentials without vendor intervention.
CVE-2019-3910
PUBLISHED: 2019-01-18
Crestron AM-100 before firmware version 1.6.0.2 contains an authentication bypass in the web interface's return.cgi script. Unauthenticated remote users can use the bypass to access some administrator functionality such as configuring update sources and rebooting the device.