|
DAN VERTON
Experts predict major cyberattack coming
A terrorist-sponsored cyberattack against major U.S. networks and businesses is no longer a question of if, but when and to what extent, according to former senior intelligence and security officials.
Source: Computerworld.com
Although the laundry list of warnings surrounding possible attacks has left people confused about what to prepare for, many experts with firsthand experience in counterterrorism said plans should be put in place to respond to a conventional bombing or chemical attack against a prominent private U.S. company, which would be followed closely by a cyber- or physical attack against regional communications and power systems to hamper rescue and recovery efforts.
A former senior intelligence official said companies considered American icons, such as General Electric Co., General Motors Corp. or IBM, could find themselves under siege.
The ex-official, who requested anonymity, said it's urgent that secure communications channels be established between CEOs of large multinational companies and government agencies such as local FBI offices.
Despite reports that Osama bin Laden has ordered the direct targeting of U.S. economic symbols, there has been no evidence to suggest that traditional terrorist groups have abandoned bombs and guns for computers, said Eric Shaw, a former CIA profiler who now works at Stroz Associates LLC, a cybercrime consulting firm in New York.
Plot Against Microsoft?
Global corporations, especially ones with ties to India or Israel, are big targets, Shaw said. In fact, he added, shortly after Indian authorities apprehended an al-Qaeda operative who warned of the December 2001 attack against the Indian Parliament, the suspect reportedly confessed to having knowledge of an infiltration operation against Microsoft Corp.
Microsoft spokesman Matt Pilla said the company hasn't been contacted by Indian authorities. But based on an internal security review and the various claims made by the suspect, the company doesn't consider the threat to be credible. However, Pilla said, Microsoft has beefed up both network and physical security around its corporate offices in the wake of Sept. 11.
Microsoft likely wouldn't be the only company targeted by so-called hackers for hire, experts said.
There are thousands of hackers capable of causing significant regional disruptions of the telecommunications and power grids as a way to amplify the effects of a physical attack, according to Stuart McClure, president and chief technology officer of Mission Viejo, Calif.-based Foundstone Inc.
"It's also safe to say that they have the blueprints for the networks," he said.
Jim Williams, director of security solutions at Omaha-based security services company Solutionary Inc. and a former member of the FBI's San Francisco computer-intrusion squad, said the cyberthreats to the nation's telecommunications, power and emergency services systems are well documented. "These are not hypothetical vulnerabilities," Williams said. In fact, there have already been compromises that have risen to the level of an "immediate national security concern and response," he said.
A former director of one of the nation's major intelligence agencies, who requested anonymity, said a "red team" exercise in 1997 employing world-class hackers carrying out attacks aimed at degrading banking services showed that a real attack "could have done strategic damage to the money supply." The results of that study remain classified.
Two Fronts
But the former intelligence chief said a cyberattack conducted in conjunction with a major physical attack could "probably shake the foundation of the country" and lead to damages "in the trillions of dollars."
Although he doesn't expect a cyberincident that security professionals haven't seen before, King Nelson, a CIO with Pittsburgh-based Tatum CIO Partners LLP, which provides companies with permanent, interim or project CIOs , said it's incumbent upon executives at large companies to plan ahead.
"Until now, my job was to provide an infrastructure and protect my company," said Nelson. "Now, I have to protect the country and the economy."
Home | What's New | Articles | Links
Library | Staff | Contact Us
Contact the CCRC Office at 380-612-735-907
[email protected]
