Risk
9/16/2011
02:12 PM
50%
50%

Energy Department Sets Roadmap For Secure Infrastructure

Agency outlines strategies for developing energy-delivery systems that are resilient even in the face of cyberattack.

50 Most Influential Government CIOs
Slideshow: 50 Most Influential Government CIOs
(click image for larger view and for slideshow)
The Department of Energy (DOE) has released a roadmap for securing the nation's energy infrastructure that envisions an energy-delivery system able to withstand a major cyber attack and still continue to operate effectively.

The Roadmap to Achieve Energy Delivery Systems Cybersecurity outlines five strategies on which the government and private-sector organizations that own and control critical energy infrastructure should collaborate to create a secure and resilient energy-delivery system in the United States.

The September 2011 roadmap--prepared by the Energy Sector Control Systems Working Group, a private-public partnership of cybersecurity experts--is an update to one released in 2006 that takes into consideration the increased sophistication of today's cyberattacks, said U.S Energy secretary Steven Chu in a statement.

"Increased insight from private-public collaborations will allow us to better protect the nation's energy delivery systems that keep our lights on and the power flowing," he said.

[Which government agencies came out ahead in the IW500 competition? See 15 Government IT Innovators: InformationWeek 500.]

The plan calls for officials to create a culture of security that includes better risk-management practices that are periodically reviewed and challenged. This should ensure that security controls remain in place and continue to be effective even among changes to the energy-delivery system or emerging threats, according to the DOE.

Private and public stakeholders also should assess and monitor risk so they can respond to evolving cyberthreats and vulnerabilities, according to the roadmap.

Another aspect of the plan is an increased ability to manage cyber incidents when preventative measures aren't effective, according to the DOE. Stakeholders should put in place better detection, remediation, recovery, and restoration methods that can mitigate the impact of an incident, as well as conduct post-incident analysis and forensics to learn from attacks.

Finally, the roadmap calls for the energy sector to sustain security improvements by committing the resources to do so, as well as to ensure that collaboration between public and private stakeholders doesn't falter, according to the DOE.

The roadmap does note some barriers to achieving these goals. Among them are a shortage of skilled engineers and craft workers in the energy industry; limited knowledge, understanding, and appreciation of the security risks of energy-delivery systems; and a rapidly changing security risk environment.

Security experts long have worried about threats to U.S. critical infrastructure such as the power grid, and the Obama administration has implemented a number of initiatives--such as smart-grid collaboration and technology standards from the National Institute of Standards and Technology--to help the private sector to bolster security in this area.

Last year a research firm estimated that utility companies will invest more than $21 billion on cybersecurity by 2015 to protect the world's electrical grids.

In the new, all-digital issue of InformationWeek Government: As federal agencies close data centers, they must drive up utilization of their remaining systems. That requires a well-conceived virtualization strategy. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2015-4233
Published: 2015-07-02
SQL injection vulnerability in Cisco Unified MeetingPlace 8.6(1.2) allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors, aka Bug ID CSCuu54037.

CVE-2014-1750
Published: 2015-07-01
Open redirect vulnerability in nokia-mapsplaces.php in the Nokia Maps & Places plugin 1.6.6 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the href parameter to page/place.html. NOTE: this was originally reported as cross-sit...

CVE-2014-1836
Published: 2015-07-01
Absolute path traversal vulnerability in htdocs/libraries/image-editor/image-edit.php in ImpressCMS before 1.3.6 allows remote attackers to delete arbitrary files via a full pathname in the image_path parameter in a cancel action.

CVE-2015-0848
Published: 2015-07-01
Heap-based buffer overflow in libwmf 0.2.8.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted BMP image.

CVE-2015-1330
Published: 2015-07-01
unattended-upgrades before 0.86.1 does not properly authenticate packages when the (1) force-confold or (2) force-confnew dpkg options are enabled in the DPkg::Options::* apt configuration, which allows remote man-in-the-middle attackers to upload and execute arbitrary packages via unspecified vecto...

Dark Reading Radio
Archived Dark Reading Radio
Marc Spitler, co-author of the Verizon DBIR will share some of the lesser-known but most intriguing tidbits from the massive report