Risk
9/16/2011
02:12 PM
Connect Directly
RSS
E-Mail
50%
50%

Energy Department Sets Roadmap For Secure Infrastructure

Agency outlines strategies for developing energy-delivery systems that are resilient even in the face of cyberattack.

50 Most Influential Government CIOs
Slideshow: 50 Most Influential Government CIOs
(click image for larger view and for slideshow)
The Department of Energy (DOE) has released a roadmap for securing the nation's energy infrastructure that envisions an energy-delivery system able to withstand a major cyber attack and still continue to operate effectively.

The Roadmap to Achieve Energy Delivery Systems Cybersecurity outlines five strategies on which the government and private-sector organizations that own and control critical energy infrastructure should collaborate to create a secure and resilient energy-delivery system in the United States.

The September 2011 roadmap--prepared by the Energy Sector Control Systems Working Group, a private-public partnership of cybersecurity experts--is an update to one released in 2006 that takes into consideration the increased sophistication of today's cyberattacks, said U.S Energy secretary Steven Chu in a statement.

"Increased insight from private-public collaborations will allow us to better protect the nation's energy delivery systems that keep our lights on and the power flowing," he said.

[Which government agencies came out ahead in the IW500 competition? See 15 Government IT Innovators: InformationWeek 500.]

The plan calls for officials to create a culture of security that includes better risk-management practices that are periodically reviewed and challenged. This should ensure that security controls remain in place and continue to be effective even among changes to the energy-delivery system or emerging threats, according to the DOE.

Private and public stakeholders also should assess and monitor risk so they can respond to evolving cyberthreats and vulnerabilities, according to the roadmap.

Another aspect of the plan is an increased ability to manage cyber incidents when preventative measures aren't effective, according to the DOE. Stakeholders should put in place better detection, remediation, recovery, and restoration methods that can mitigate the impact of an incident, as well as conduct post-incident analysis and forensics to learn from attacks.

Finally, the roadmap calls for the energy sector to sustain security improvements by committing the resources to do so, as well as to ensure that collaboration between public and private stakeholders doesn't falter, according to the DOE.

The roadmap does note some barriers to achieving these goals. Among them are a shortage of skilled engineers and craft workers in the energy industry; limited knowledge, understanding, and appreciation of the security risks of energy-delivery systems; and a rapidly changing security risk environment.

Security experts long have worried about threats to U.S. critical infrastructure such as the power grid, and the Obama administration has implemented a number of initiatives--such as smart-grid collaboration and technology standards from the National Institute of Standards and Technology--to help the private sector to bolster security in this area.

Last year a research firm estimated that utility companies will invest more than $21 billion on cybersecurity by 2015 to protect the world's electrical grids.

In the new, all-digital issue of InformationWeek Government: As federal agencies close data centers, they must drive up utilization of their remaining systems. That requires a well-conceived virtualization strategy. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3341
Published: 2014-08-19
The SNMP module in Cisco NX-OS 7.0(3)N1(1) and earlier on Nexus 5000 and 6000 devices provides different error messages for invalid requests depending on whether the VLAN ID exists, which allows remote attackers to enumerate VLANs via a series of requests, aka Bug ID CSCup85616.

CVE-2014-3464
Published: 2014-08-19
The EJB invocation handler implementation in Red Hat JBossWS, as used in JBoss Enterprise Application Platform (EAP) 6.2.0 and 6.3.0, does not properly enforce the method level restrictions for outbound messages, which allows remote authenticated users to access otherwise restricted JAX-WS handlers ...

CVE-2014-3472
Published: 2014-08-19
The isCallerInRole function in SimpleSecurityManager in JBoss Application Server (AS) 7, as used in Red Hat JBoss Enterprise Application Platform (JBEAP) 6.3.0, does not properly check caller roles, which allows remote authenticated users to bypass access restrictions via unspecified vectors.

CVE-2014-3490
Published: 2014-08-19
RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have...

CVE-2014-3504
Published: 2014-08-19
The (1) serf_ssl_cert_issuer, (2) serf_ssl_cert_subject, and (3) serf_ssl_cert_certificate functions in Serf 0.2.0 through 1.3.x before 1.3.7 does not properly handle a NUL byte in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which allows man-in-the-middle attackers...

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Dark Reading continuing coverage of the Black Hat 2014 conference brings interviews and commentary to Dark Reading listeners.