Experts: Stuxnet changed the cybersecurity landscape

The level of sophistication in the worm should serve as a wake-up call, cybersecurity experts say

The appearance of the Stuxnet worm in June should serve as a wake-up call to governments and businesses, especially those relying on Internet-based industrial control systems, a group of cybersecurity experts told U.S. lawmakers Wednesday.

The sophisticated Stuxnet is a "game changer" for companies and governments looking to protect their networks, said Sean McGurk, acting director of the National Cybersecurity and Communications Integration Center in the U.S. Department of Homeland Security. Stuxnet, likely developed by a well-financed team, modifies files of the software running industrial control systems and can also steal the data contained there without the owner knowing it, he told the U.S. Senate Homeland Security and Governmental Affairs Committee.

"We have not seen this coordinated effort of information technology vulnerabilities and industrial control exploitation completely wrapped up in one unique package," McGurk said.

Stuxnet illustrates the need for governments and businesses to adopt new approaches to cyberthreats, added Michael Assante, president and CEO of the National Board of Information Security Examiners. "Stuxnet is, at the very least, an important wake-up call for digitally enhanced and reliant countries, and at its worst, a blueprint for future attackers," he said.

As of last week, there were still about 44,000 computers infected with Stuxnet worldwide, with about 60 percent of them in Iran, said Dean Turner, director of Symantec's Global Intelligence Network. About 1,600 of the current infections are in the U.S., he said.

There has been some speculation, including some from Symantec, that Stuxnet targeted Iran's attempts to enrich uranium. But it's impossible to determine the target or the source of the worm, Turner said. While the sophistication of Stuxnet likely means there won't be huge numbers of similar attacks, more are coming, he added.

"Our level of preparedness to some degree -- certainly in the private sector -- is better than it ever has been, but still has a long way to go," Turner said. "It often is a cliché, but we don't know what we don't know. How vulnerable are industrial control systems ... in the United States and anywhere else? It's a difficult question to answer."

Despite the witnesses calling for swift action, the Senate is unlikely to act on a comprehensive cybersecurity bill this year, said Senator Joe Lieberman, a Connecticut independent and committee chairman. The Protecting Cyberspace as a National Asset Act, introduced by Lieberman and other committee members in June, will be a top priority for the committee next year, he said.

Assante criticized past cybersecurity efforts focused on complying with lists of requirements, naming reliability standards released by the North American Electric Reliability Corp., or NERC. The group's standards are focused on perimeter protection and don't take into account new types of threats, he said.

The standards also contain several gaps and have imposed requirements in a fast-changing environment, causing the industry to be polarized, he said. "The result has been a conscious and inevitable retreat to a compliance/checklist-focused approach to the security of the bulk power system," Assante said.

Instead, the U.S. government and businesses operating industrial control systems should focus on integrating forensic and security tools into the systems, pour more money into security research and spend more time training cybersecurity workers with attack simulations and other tools, Assante said.

Organizations operating industrial control systems also need to better enforce their IT policies and authenticate users, Turner said. The U.S. government and other entities also need to focus on cybersecurity education, from school classrooms to company boardrooms, he said.

"Stuxnet demonstrates that industrial control systems are more vulnerable to cyberattacks than in the past for several reasons, including their increased connectivity to other systems and the Internet," he said. "Further, as demonstrated by past attacks and incidents involving industrial control systems, the impact on a critical infrastructure could be substantial."

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags North American Electric Reliability Corp.Joe LiebermansecuritySean McGurkU.S. Department of Homeland SecuritylegislationgovernmentMichael AssanteantivirusNational Board of Information Security Examinerssymantec

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Grant Gross

IDG News Service
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?