Perimeter
4/9/2012
11:01 AM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

How Much Money Do You Need To Lose Before You Start Monitoring?

At what point does turning a blind eye to the loss of revenue spark the inevitable conversation: 'Maybe we should be monitoring this infrastructure more closely?'

A new blog post by Brian Krebs states that the FBI has released a cyberintelligence bulletin claiming that a series of hacks perpetrated against smart-meter installations over the past several years may cost a Puerto Rican electric utility upward of $400 million annually.

According to the post, the FBI said it believes former employees of the meter manufacturer and employees of the utility were altering the meters in exchange for cash and training others to do so. "These individuals are charging $300 to $1,000 to reprogram residential meters, and about $3,000 to reprogram commercial meters," the alert states.

The FBI also said another method of attacking the meters involves placing a strong magnet on the devices, which causes it to stop measuring usage, while still providing electricity to the customer. The article also stated that the hacks described by the FBI did not work remotely and require physical access to the devices.

What I don't understand is how something like this could have gone undetected. If a house, building, or complex has a baseline of usage that suddenly changes (without an associated work order), that's what we in the SIEM world call an anomaly. Why are utilities deploying "smart meters" without accompanying smart monitors?

I'm not saying that the utilities have to use a SIEM product, per se, but they should be implementing some monitoring controls for their environments. If a company is buying the metering technology, then shouldn’t it be pushing for a way to effectively manage and monitor said technology? If an anomaly detection technology or analytical engine was laid atop the company’s usage and billing system, then I would think it would be fairly obvious to notice that something was wrong and that someone should be dispatched to investigate.

Getting down to brass tacks here, monitoring the smart infrastructure would enable the company to protect its infrastructure investment, customer base, and competitive edge, as well as its ability to generate (and collect) revenue. I mean, really, at what point does losing $400 million per year become a problem to the business?

Andrew Hay is senior analyst with 451 Research's Enterprise Security Practice (ESP) and is an author of three network security books. Follow him on Twitter: @andrewsmhay

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Latest Comment: LOL.
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6213
Published: 2014-04-19
Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 Patch 1 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1833.

CVE-2013-6214
Published: 2014-04-19
Unspecified vulnerability in the Integration Service in HP Universal Configuration Management Database 9.05, 10.01, and 10.10 allows remote authenticated users to obtain sensitive information via unknown vectors, aka ZDI-CAN-2042.

CVE-2012-0871
Published: 2014-04-18
The session_link_x11_socket function in login/logind-session.c in systemd-logind in systemd, possibly 37 and earlier, allows local users to create or overwrite arbitrary files via a symlink attack on the X11 user directory in /run/user/.

CVE-2012-6646
Published: 2014-04-18
F-Secure Anti-Virus, Safe Anywhere, and PSB Workstation Security before 11500 for Mac OS X allows local users to disable the Mac OS X firewall via unspecified vectors.

CVE-2013-4279
Published: 2014-04-18
imapsync 1.564 and earlier performs a release check by default, which sends sensitive information (imapsync, operating system, and Perl version) to the developer's site.

Best of the Web