The appearance of the Stuxnet worm in June should serve as a wake-up call to governments and businesses, especially those relying on Internet-based industrial control systems, a group of cybersecurity experts told U.S. lawmakers Wednesday.
The sophisticated Stuxnet is a "game changer" for companies and governments looking to protect their networks, said Sean McGurk, acting director of the National Cybersecurity and Communications Integration Center in the U.S. Department of Homeland Security. Stuxnet, likely developed by a well-financed team, modifies files of the software running industrial control systems and can also steal the data contained there without the owner knowing it, he told the U.S. Senate Homeland Security and Governmental Affairs Committee.
"We have not seen this coordinated effort of information technology vulnerabilities and industrial control exploitation completely wrapped up in one unique package," McGurk said.
Stuxnet illustrates the need for governments and businesses to adopt new approaches to cyberthreats, added Michael Assante, president and CEO of the National Board of Information Security Examiners. "Stuxnet is, at the very least, an important wake-up call for digitally enhanced and reliant countries, and at its worst, a blueprint for future attackers," he said.
As of last week, there were still about 44,000 computers infected with Stuxnet worldwide, with about 60 percent of them in Iran, said Dean Turner, director of Symantec's Global Intelligence Network. About 1,600 of the current infections are in the U.S., he said.
There has been some speculation, including some from Symantec, that Stuxnet targeted Iran's attempts to enrich uranium. But it's impossible to determine the target or the source of the worm, Turner said. While the sophistication of Stuxnet likely means there won't be huge numbers of similar attacks, more are coming, he added.
"Our level of preparedness to some degree -- certainly in the private sector -- is better than it ever has been, but still has a long way to go," Turner said. "It often is a cliché, but we don't know what we don't know. How vulnerable are industrial control systems ... in the United States and anywhere else? It's a difficult question to answer."
Despite the witnesses calling for swift action, the Senate is unlikely to act on a comprehensive cybersecurity bill this year, said Senator Joe Lieberman, a Connecticut independent and committee chairman. The Protecting Cyberspace as a National Asset Act, introduced by Lieberman and other committee members in June, will be a top priority for the committee next year, he said.
Assante criticized past cybersecurity efforts focused on complying with lists of requirements, naming reliability standards released by the North American Electric Reliability Corp., or NERC. The group's standards are focused on perimeter protection and don't take into account new types of threats, he said.
The standards also contain several gaps and have imposed requirements in a fast-changing environment, causing the industry to be polarized, he said. "The result has been a conscious and inevitable retreat to a compliance/checklist-focused approach to the security of the bulk power system," Assante said.
Instead, the U.S. government and businesses operating industrial control systems should focus on integrating forensic and security tools into the systems, pour more money into security research and spend more time training cybersecurity workers with attack simulations and other tools, Assante said.
Organizations operating industrial control systems also need to better enforce their IT policies and authenticate users, Turner said. The U.S. government and other entities also need to focus on cybersecurity education, from school classrooms to company boardrooms, he said.
"Stuxnet demonstrates that industrial control systems are more vulnerable to cyberattacks than in the past for several reasons, including their increased connectivity to other systems and the Internet," he said. "Further, as demonstrated by past attacks and incidents involving industrial control systems, the impact on a critical infrastructure could be substantial."
Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant's e-mail address is grant_gross@idg.com.
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.