Experts: Stuxnet changed the cybersecurity landscape

The level of sophistication in the worm should serve as a wake-up call, cybersecurity experts say

The appearance of the Stuxnet worm in June should serve as a wake-up call to governments and businesses, especially those relying on Internet-based industrial control systems, a group of cybersecurity experts told U.S. lawmakers Wednesday.

The sophisticated Stuxnet is a "game changer" for companies and governments looking to protect their networks, said Sean McGurk, acting director of the National Cybersecurity and Communications Integration Center in the U.S. Department of Homeland Security. Stuxnet, likely developed by a well-financed team, modifies files of the software running industrial control systems and can also steal the data contained there without the owner knowing it, he told the U.S. Senate Homeland Security and Governmental Affairs Committee.

"We have not seen this coordinated effort of information technology vulnerabilities and industrial control exploitation completely wrapped up in one unique package," McGurk said.

Stuxnet illustrates the need for governments and businesses to adopt new approaches to cyberthreats, added Michael Assante, president and CEO of the National Board of Information Security Examiners. "Stuxnet is, at the very least, an important wake-up call for digitally enhanced and reliant countries, and at its worst, a blueprint for future attackers," he said.

As of last week, there were still about 44,000 computers infected with Stuxnet worldwide, with about 60 percent of them in Iran, said Dean Turner, director of Symantec's Global Intelligence Network. About 1,600 of the current infections are in the U.S., he said.

There has been some speculation, including some from Symantec, that Stuxnet targeted Iran's attempts to enrich uranium. But it's impossible to determine the target or the source of the worm, Turner said. While the sophistication of Stuxnet likely means there won't be huge numbers of similar attacks, more are coming, he added.

"Our level of preparedness to some degree -- certainly in the private sector -- is better than it ever has been, but still has a long way to go," Turner said. "It often is a cliché, but we don't know what we don't know. How vulnerable are industrial control systems ... in the United States and anywhere else? It's a difficult question to answer."

Despite the witnesses calling for swift action, the Senate is unlikely to act on a comprehensive cybersecurity bill this year, said Senator Joe Lieberman, a Connecticut independent and committee chairman. The Protecting Cyberspace as a National Asset Act, introduced by Lieberman and other committee members in June, will be a top priority for the committee next year, he said.

Assante criticized past cybersecurity efforts focused on complying with lists of requirements, naming reliability standards released by the North American Electric Reliability Corp., or NERC. The group's standards are focused on perimeter protection and don't take into account new types of threats, he said.

The standards also contain several gaps and have imposed requirements in a fast-changing environment, causing the industry to be polarized, he said. "The result has been a conscious and inevitable retreat to a compliance/checklist-focused approach to the security of the bulk power system," Assante said.

Instead, the U.S. government and businesses operating industrial control systems should focus on integrating forensic and security tools into the systems, pour more money into security research and spend more time training cybersecurity workers with attack simulations and other tools, Assante said.

Organizations operating industrial control systems also need to better enforce their IT policies and authenticate users, Turner said. The U.S. government and other entities also need to focus on cybersecurity education, from school classrooms to company boardrooms, he said.

"Stuxnet demonstrates that industrial control systems are more vulnerable to cyberattacks than in the past for several reasons, including their increased connectivity to other systems and the Internet," he said. "Further, as demonstrated by past attacks and incidents involving industrial control systems, the impact on a critical infrastructure could be substantial."

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags governmentsecuritylegislationsymantecantivirusU.S. Department of Homeland SecurityJoe LiebermanSean McGurkNorth American Electric Reliability Corp.Michael AssanteNational Board of Information Security Examiners

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Grant Gross

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?