Risk
7/10/2008
11:34 PM
George V. Hulme
George V. Hulme
Commentary
Connect Directly
RSS
E-Mail
50%
50%

EMP Risk Follow-Up: Blather O'Plenty, No Action

As we discussed yesterday, it's been four years since Congress was fully briefed on our nation's vulnerability to an Electromagnetic Pulse (EMP) Attack, and the debilitating impact it would have on our electro-dependent society.

As we discussed yesterday, it's been four years since Congress was fully briefed on our nation's vulnerability to an Electromagnetic Pulse (EMP) Attack, and the debilitating impact it would have on our electro-dependent society.And what steps have we taken to prepare against such an attack? You guessed it: None.

For a background on what we're talking about, and the nature of the threat, check out yesterday's post.

This afternoon, the House Armed Services Committee heard testimony on the threat of an EMP attack. But few congressmen showed up to listen. From today's DefenseNews coverage:

Only a handful of the 60 members of the House Armed Services Committee showed up for a hearing on the EMP threat July 10, and most didn't stick around for the whole two-hour session.

"It's obvious that there's not very much interest in it," said Rep. Roscoe Bartlett, R-Md., who asked for the hearing. "There are lots of seats vacant," he lamented.

While Congress may be horrendously complacent about this vulnerability to our high-tech society, the Iranians, apparently, are looking at this as if it is our Achilles' heel.

From today's Editorial & Opinion section in Investor's Business Daily:

Apparently the Iranians are aware of it [EMP threat], judging from articles in the Iranian press. For example, an analysis in the Iranian journal Siasat-e Defai (Farsi for defense policy) in March 2001 weighed the use of nuclear weapons against cities in the traditional manner, as "against Japan in World War II," vs. its use in "information warfare" that includes "electromagnetic pulse . . . for the destruction of integrated circuits."

Another article published in Nashriyeh-e Siasi Nezami (December 1998-January 1999) warned that "if the world's industrial countries fail to devise effective ways to defend themselves against dangerous electronic assaults, then they will disintegrate with a few years."

Today's Wall Street Journal addressed the threat of such a missile attack, and added to the EMP threat discussion:

Iran may already have the capability to target the U.S. with a short-range missile by launching it from a freighter off the East Coast. A few years ago it was observed practicing the launch of Scuds from a barge in the Caspian Sea.

This would be especially troubling if Tehran is developing EMP -- electromagnetic pulse -- technology. A nuclear weapon detonated a hundred miles over U.S. territory would create an electromagnetic pulse that would virtually shut down the U.S. economy by destroying electronic circuits on the ground.

The "electronic circuits" that would be affected range from the entire power grid, to medical devices, to the computer you're using to read this post, to your car's ignition. Kiss the power grid goodbye for a few months to a year; everything else is fried beyond repair.

Our advisories apparently see the cost benefit of a single-missile attack that would shut down the entire country's access to anything electronic for months to years.

It's time we -- and our leaders -- also take a closer look.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-1556
Published: 2014-09-12
Cross-site scripting (XSS) vulnerability in Synology Photo Station 5 for DiskStation Manager (DSM) 3.2-1955 allows remote attackers to inject arbitrary web script or HTML via the name parameter to photo/photo_one.php.

CVE-2014-2008
Published: 2014-09-12
SQL injection vulnerability in confirm.php in the mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to execute arbitrary SQL commands via the TID parameter.

CVE-2014-2009
Published: 2014-09-12
The mPAY24 payment module before 1.6 for PrestaShop allows remote attackers to obtain credentials, the installation path, and other sensitive information via a direct request to api/curllog.log.

CVE-2014-4735
Published: 2014-09-12
Cross-site scripting (XSS) vulnerability in MyWebSQL 3.4 and earlier allows remote attackers to inject arbitrary web script or HTML via the table parameter to index.php.

CVE-2014-5259
Published: 2014-09-12
Cross-site scripting (XSS) vulnerability in cattranslate.php in the CatTranslate JQuery plugin in BlackCat CMS 1.0.3 and earlier allows remote attackers to inject arbitrary web script or HTML via the msg parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
CISO Insider: An Interview with James Christiansen, Vice President, Information Risk Management, Office of the CISO, Accuvant