Learn how to Take Down a State's Power Grid, Transportation System, and Other Critical Infrastructure

President Obama wrote an Op-Ed piece for the Wall Street Journal last Friday which described a catastrophic attack against the transportation and water sectors of our nation's critical infrastructure. He then pressed for passage of comprehensive cyber security legislation. While Congress and the White House have a sense of what might occur, they don't seem to be aware of the technical vulnerabilities involved or they would know that none of the current cyber security bills pending in Congress could stop such an attack even if they were enacted into law.


Therefore I've decided to invite some of the world's leading experts in protecting critical infrastructure to present how they would mount an offensive attack against their respective industry sectors at the next Suits and Spooks anti-conference to be held October 18th, 2012 in Brookline, MA. For obvious reasons, this event will be closed to the press and none of the presentations will be made public. 


One of our speakers will be Dale Peterson, the founder of Digital Bond, Inc., a control system consulting and research firm that also hosts the most visited SCADA security site and the S4 conference. He began work on control system security in 2000 after beginning his security career as an NSA cryptanalyst. In his presentation for Suits and Spooks Boston, Dale will provide detailed scenarios on how how an adversary would take out thousands of power plants around the world or large parts of the electric transmission system. 


Another one of our speakers will be Rob DuBois, a retired U.S. Navy SEAL and current manager for Red Team operations at a U.S. defense contractor. Since the threats aren't only digital, Rob will walk the audience through how a highly trained team would mount a physical attack against a key facility.


Our keynote speaker will be Dr. David A. Bray who currently serves as Principal Strategist and Senior National Intelligence Service Executive with the National Commission for Review of Research and Development Programs of the U.S. Intelligence Community. Prior to joining ISE, Dr. Bray served as a strategist at the Institute for Defense Analyses and the Science and Technology Policy Institute. In 2009, he deployed to Afghanistan as a Special Advisor to STRATEGIC EFFECTS for NATO’s International Security Assistance Force and U.S. Forces Afghanistan, with the task of helping to “think differently” on critical strategic efforts. Dr. Bray also served as IT Chief for the Bioterrorism Preparedness and Response Program at the U.S. Centers for Disease Control and Prevention, where he led the technology aspects of the bioterrorism program’s response to 9/11, anthrax in 2001, SARS, and other outbreaks. 


This will be the fourth Suits and Spooks event since I first started holding them in September of 2011 and it may be the most critical one yet. The information that will be shared on October 18th by our speakers (a complete list is available at the website) will clearly lay out offensive options that could wreak havoc on up to six key components of critical infrastructure - water, power, transportation, communication, health care, and banking. Due to the timeliness and the importance of this topic, we're going to cap attendance at 130 instead of 100. If you'd like to be part of this history-making event, registration begins today.

Add to Cart View detail

NERC's Latest Security Blunder And How To Fix It

It is important to note that NERC and the electric industry can only develop risk based security policies that deal with the risks they are aware of. 

-  Gerry Cauley, President and Chief Executive Officer North American Electric Reliability Corporation (NERC)

On February 11, 2011, Gerry Cauley, the new President and CEO of NERC testified before the House Armed Services Committee's Subcommittee on Emerging Threats and Capabilities. You can read the transcript here. I liked a lot of what Mr. Cauley had to say until I got to the section entitled "Information Exchange Is Critical" and read that NERC's security policy relies on known risks. Frankly, I'm stunned by the implications of that statement. Imagine what would happen if other organizations tasked with security adopted that posture? 

• US Secret Service: "Mrs. Obama, we understand that you're upset however the Service cannot be held responsible for protecting the President against threats that we don't already know about."
• TSA: "Don't blame us. No one had ever hid a bomb in their underwear before."

Actually, the TSA used to be as clueless as NERC about how to manage security until John Pistole took over in July, 2010. When your entire security posture is built upon the assumption that an adversary will repeat a past attack strategy that he's already used and that you're prepared to detect and defend against, you'll always be blind-sided by a novel attack.

In his testimony, Cauley goes on to stress the importance of increased information exchange with the federal government; that without "actionable intelligence", the companies that compose the Bulk Power Grid will always be "a step behind when it comes to protecting against potential threats and unknown vulnerabilities." On its face, this seems perfectly reasonable however if Cauley is expecting any federal agency to act like a cyber version of NORAD and alert NERC when a "cyber missile" is on its way to attack an energy provider in the Western Interconnect of the Grid, I'd like to have some of whatever he's smoking because that's never going to happen. 

NERC has so much that it must do to clean up its own house and redress its members' lengthy history of avoiding spending money on security by inventing ludicrous loopholes like "assumption of risk" and "reasonable business judgment" that Cauley's comments about increased information exchange are premature at best. A better approach might be a public commitment by CEO Cauley that NERC's entire membership will dedicate itself to implementing SANS 20 Critical Security Controls, regardless of the cost. There's no point in discussing how to anticipate future attacks when some Independent System Operators still don't have immutable audit logs or are afraid to apply patches for fear of breaking their antiquated networks. When the time comes that NERC and its membership is actually prepared to benefit from a forward-looking threat intelligence capability, the first thing that they should know is that the definition of security is managing risk from both known and unknown threat entities.

Add to Cart View detail