Risk
9/16/2011
02:12 PM
50%
50%

Energy Department Sets Roadmap For Secure Infrastructure

Agency outlines strategies for developing energy-delivery systems that are resilient even in the face of cyberattack.

50 Most Influential Government CIOs
Slideshow: 50 Most Influential Government CIOs
(click image for larger view and for slideshow)
The Department of Energy (DOE) has released a roadmap for securing the nation's energy infrastructure that envisions an energy-delivery system able to withstand a major cyber attack and still continue to operate effectively.

The Roadmap to Achieve Energy Delivery Systems Cybersecurity outlines five strategies on which the government and private-sector organizations that own and control critical energy infrastructure should collaborate to create a secure and resilient energy-delivery system in the United States.

The September 2011 roadmap--prepared by the Energy Sector Control Systems Working Group, a private-public partnership of cybersecurity experts--is an update to one released in 2006 that takes into consideration the increased sophistication of today's cyberattacks, said U.S Energy secretary Steven Chu in a statement.

"Increased insight from private-public collaborations will allow us to better protect the nation's energy delivery systems that keep our lights on and the power flowing," he said.

[Which government agencies came out ahead in the IW500 competition? See 15 Government IT Innovators: InformationWeek 500.]

The plan calls for officials to create a culture of security that includes better risk-management practices that are periodically reviewed and challenged. This should ensure that security controls remain in place and continue to be effective even among changes to the energy-delivery system or emerging threats, according to the DOE.

Private and public stakeholders also should assess and monitor risk so they can respond to evolving cyberthreats and vulnerabilities, according to the roadmap.

Another aspect of the plan is an increased ability to manage cyber incidents when preventative measures aren't effective, according to the DOE. Stakeholders should put in place better detection, remediation, recovery, and restoration methods that can mitigate the impact of an incident, as well as conduct post-incident analysis and forensics to learn from attacks.

Finally, the roadmap calls for the energy sector to sustain security improvements by committing the resources to do so, as well as to ensure that collaboration between public and private stakeholders doesn't falter, according to the DOE.

The roadmap does note some barriers to achieving these goals. Among them are a shortage of skilled engineers and craft workers in the energy industry; limited knowledge, understanding, and appreciation of the security risks of energy-delivery systems; and a rapidly changing security risk environment.

Security experts long have worried about threats to U.S. critical infrastructure such as the power grid, and the Obama administration has implemented a number of initiatives--such as smart-grid collaboration and technology standards from the National Institute of Standards and Technology--to help the private sector to bolster security in this area.

Last year a research firm estimated that utility companies will invest more than $21 billion on cybersecurity by 2015 to protect the world's electrical grids.

In the new, all-digital issue of InformationWeek Government: As federal agencies close data centers, they must drive up utilization of their remaining systems. That requires a well-conceived virtualization strategy. Download the issue now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7830
Published: 2014-11-24
Cross-site scripting (XSS) vulnerability in mod/feedback/mapcourse.php in the Feedback module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to inject arbitrary web script or HTML by leveraging the mod/feedback:mapcourse cap...

CVE-2014-7831
Published: 2014-11-24
lib/classes/grades_external.php in Moodle 2.7.x before 2.7.3 does not consider the moodle/grade:viewhidden capability before displaying hidden grades, which allows remote authenticated users to obtain sensitive information by leveraging the student role to access the get_grades web service.

CVE-2014-7832
Published: 2014-11-24
mod/lti/launch.php in the LTI module in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 performs access control at the course level rather than at the activity level, which allows remote authenticated users to bypass the mod/lti:view capability requirement by vi...

CVE-2014-7833
Published: 2014-11-24
mod/data/edit.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 sets a certain group ID to zero upon a database-entry change, which allows remote authenticated users to obtain sensitive information by accessing the database after an edit by a teacher.

CVE-2014-7834
Published: 2014-11-24
mod/forum/externallib.php in Moodle 2.6.x before 2.6.6 and 2.7.x before 2.7.3 does not verify group permissions, which allows remote authenticated users to access a forum via the forum_get_discussions web service.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?