Panetta Issues Cybersecurity Clarion Call...But Why?

The big cybersecurity news of the week is Defense Secretary Leon Panetta's high-profile clarion call for the Congress to pass a cybersecurity bill because the U.S.otherwise faces a possible "cyber-Pearl Harbor."  During his speech at an award dinner hosted by a group of security-focused business executives, Panetta also hinted that the government's interest isn't merely in defending against critical cyber threats but could extend to something more proactive.  "If we detect an imminent threat of attack that will cause significant physical destruction in the United States or kill American citizens, we need to have the option to take action against those who would attack us, to defend this nation when directed by the president," Panetta said. 

The speech is notable for three things. First, it's the most comprehensive statement by the Defense Secretary on the issue.  Secondly, it's clearly timed to either push the Congress into immediate action on passing a cybersecurity bill during the lame duck Congress or provide the President with enough rhetorical cover if he does issue an executive order on cybersecurity.  Finally, although the spin by administration flacks was that Panetta was disclosing new previously classified threats in his speech, the examples he offered -- DDoS attacks on U.S. financial institutions and the Shamoon malware that plagued Aramco and RasGas late this summer -- are all old news in cybersecurity terms, as Wired's Noah Schachtman points out. 

But why amp up the rhetoric regarding threats that are, by now, extensively known?  And for that matter, why is the Administration turning up the heat on the issue in general?  There is no question that cyberthreats are the 21st century version of nuclear warfare and should be much feared.  But, Republicans and business lobbies oppose anything beyond simple information sharing, and the relatively arcane issue of cybersecurity won't interest or sway many voters, so the Obama Administration stands to gain very little politically by continuing to push the issue. 

The clues to the puzzle of why Obama is pressing cybersecurity so hard are shrouded by the nature of the subject matter itself.  If there were a new threat on the horizon that could derail trains or "contaminate the water supply in major cities, or shut down the power grid across large parts of the country," as Panetta said in his speech, only a handful of people are allowed to know that, just as only a handful of people are allowed to know the launch codes for nuclear weapons. Panetta isn't going to trot out the latest intelligence on a potentially catastrophic cyber weapon during a black tie dinner and we are likely never going to hear what's really going on, or at least not for years.

It's also possible that the Administration plans to ramp up its own military capabilities in the cyber realm and the strong language used by Panetta (and others) helps to provide cover for stepped-up military action.  The U.S., after all, is the creator of the most potent cyber weapon the world has known so far (Stuxnet) and the Administration could be beefing up its military muscles not necessarily to defend against threats but to take the offense against enemies.

Whatever the case may be, the Administration is getting more serious every day about cybersecurity.  And we may never know why.

Shamoon image via SecureList

Read More

Rogers: White House “Irresponsible” for Failing to Consult on Cyber Executive Order

House Intelligence Committee Chairman Mike Rogers (R-MI) said today “it’s irresponsible” that the Obama administration failed to consult with the committee while drafting the impending executive order on cybersecurity.  Speaking at a U.S. Chamber of Commerce Cybersecurity Summit, Rogers said “we have been consulted as much as you have been consulted, which is a huge problem. “

“I don’t get it. I don’t understand it. I think it’s irresponsible.  We’re equally as frustrated as you are.” Rogers told the mostly pro-business audience.  The U.S. Chamber of Commerce opposes the President’s cybersecurity order, which mirrors to a large degree Senate cybersecurity legislation that failed to pass in August.  The Chamber also opposed that Democractic-backed bill, arguing that it creates an unnecessary regulatory structure.

Rogers said that the White House has also failed to seek private sector input when drafting the order.  “It’s just odd you would do it this way.  Why you wouldn’t want input from the outside is beyond me and that tells me what kind of product you’re going to get too.”

Cyber security legislation, along the lines of the Cyber Intelligence Sharing and Protection Act (CISPA), still stands a chance of passage during the upcoming lame duck session of Congress, Rogers said.  Rogers was a co-sponsor and proponent of that legislation, which established a voluntary cyber threat information sharing framework.  

Boosting the bill’s chance are recent classified briefings some members of Congress have received on “what appears to be a new level of threat from an unusual source that has some very real consequences,” Rogers said.  When pressed on the nature of this new threat, Rogers was vague – “I look really bad in orange,” he quipped.  But he seemed to indicate that perhaps a new nation-state has emerged as a cyber enemy.  “Our concern is nation-states that are gaining capabilities,” was the closest he came to an explanation of the new threat.

Read More

Utilities, Tech Industry Face Culture Clash in the Smart Grid

(Washington, DC)  As the nation’s electric infrastructure struggles to get smarter, a culture clash has emerged between the rapid-pace high-tech industry and the very slow-moving utility industry as they both try to inject intelligence into the grid.  Google-backed Silicon Valley-based Silver Spring Networks has experienced this first-hand as it pitches its 21^st Century software, networking and platform solutions to utilities.

“We have to work to the biorhythms of our clients,” Eric Dresselhuys, Silver Spring’s EVP of Global Development said today at GridWeek 2012, held here.  “A utility client said ‘we don’t want you to force us into an upgrade more than every seven years.’ It made me realize the chasm we have to cross.”

“This [technology change] is coming at us in a lot of different directions,” Heather Sanders, Director of Smart Grid Technologies and Strategy, California ISO said.  The biggest challenge, Sanders said, is not technological but regulatory, with heavily rate-regulated utilities constrained by state public utility commissions in terms of how easily they can spend capital to upgrade technology.

“It's not clear that there is a regulatory meeting of the minds on how we're going to pay for this,” Dresselhuys said.  Regarding a recent case of regulatory lag in Illinois, “the absolute amount of money we're talking about here is so small, $1.50 per customer per month.  Nothing's happening and it's stunning.”

Not all utilities are foregoing technology upgrades pending regulatory approval.  “We're spending money on projects for which we don't have regulatory approval because we have to move forward,” Lee Krevat, Smart Grid Director San Diego Gas & Electric (SDG&E) said.

Indeed, SDG&E is out ahead of the industry’s vendors, asking for more up-to-date technologies than the vendors’ products offer.  “We have things that we want and they don't exist the way we want them,” Krevat said.  “It's the utility wanting to move faster than the suppliers.  It's bizarre.”

Read More

Napolitano: We Still Need Comprehensive Cybersecurity Legislation

(Washington, DC)  Although President Obama plans to issue an executive order on cybersecurity, Congress still needs to pass comprehensive cybersecurity legislation, Department of Homeland Security (DHS) Secretary Janet Napolitano said today. Speaking at the Cybersecurity Summit hosted by the National Journal and Government Executive here, Napolitano said that “an executive order will help but we still need comprehensive cybersecurity legislation.”

An executive order can’t do a lot of things that legislation can do, such as give critical infrastructure industries liability protection or give DHS relief to offer higher civil service salaries in order to attract the much in-demand specialists the agency needs.  “Congress has had a full opportunity to act and that is the preference.  Any executive order cannot do what legislation can do but in the meantime there are things the president can do under existing authority,” she said.

Some Republicans and scholars have indeed challenged the President’s legal authority to issue an executive order on cybersecurity, a thorny and complex constitutional question that has arisen time and again when the administrative branch has taken action on matters without specific Congressional directives to do so.  One option for Obama is to issue the current order as a modification of an earlier, related executive order, arguably giving him greater legal justification for this latest action.

But, Napolitano said, the current order will instead likely be in the format of a new order, not a modification of an existing order.  When asked under what authority, if not Congressional directive, the new order will be issued she said that Article II of the Constitution, which grants the President executive power and assigns him responsibility as Commander in Chief of the military, is sufficient legal authority.  (CRS has a recent and concise overview and the history of executive orders in this PDF, including discussion of Article II authority.)

When the executive order will come out is unclear.  “I can’t give you a firm timeline,” Napolitano said.  The executive order is still in draft form and the “president has not yet had an opportunity to review it.”

On the subject of cyberwar, Napolitano advocated greater international collaboration in developing conventions of use, much the way countries have cooperated in developing accepted practices regarding traditional warfare.  “It’s time for the nations of the world to have some kind of opportunity to come together and look at a global convention...for having a safe cyber environment for everybody’s benefit.  That international dialog has been missing.”

Read More

Does Obama Dare to Issue a Cybersecurity Executive Order Before Election Day?

Next Monday, the Department of Homeland Security (DHS) kicks off National Cybersecurity Awareness Month, which features events and initiatives aimed at stressing the importance of good cyber security practices.  The timing of this annual event could not be more propitious given the mounting battle between President Obama and his Republican (and business lobby) adversaries over the expected, imminent executive order on cyber security the Administration has developed in the wake of failed cyber security legislation.

A  draft of the order was circulated earlier this month and it looks a lot like the Democratic-backed Cybersecurity Act of 2012, which was aimed at setting up government programs to ensure better cyber security information sharing for critical infrastructure industries.  (One major difference between the order and the Senate bill is that the order specifies by name 16 different sectors that constitute the “critical infrastructure” industries covered by the order, although energy and communications are spelled out upfront as “uniquely” critical sectors that cut across all the other industries.)

A growing number of developments hint that the executive order could come out any day now.  DHS Secretary Janet Napolitano told the Senate last week that the order is near completion, a host of current and former Pentagon officials are speaking out daily about the threat lax cyber security poses to the nation’s welfare while the Senate champion of the Cybersecurity Act, Joe Lieberman (I-CT) is pushing the president to get the order out the door.

Does all this add up to Obama issuing the executive order before the end of October?  Not exactly.  Despite the intense pressure and momentum, this is an election year and despite Obama’s current comfortable lead in the polls and the resulting lift for all Democratic contests, some smart insiders say the Administration won’t needlessly give Republicans any new ammunition before the polls close on Election Day by issuing what is already a controversial order.   Further dimming the order's pre-election day prospects are Republican rumblings of late that the Congress might still pass a bill before Inauguration Day.  Obama might be reluctant to look like he's pulling ahead of the legislative branch, even if it’s unlikely that the lame duck Congress can get the job done. 

On the other hand, the President could gain even more points in the polls by issuing the order, burnishing his already strong image on national defense.  But, if the smart money is right, look for an executive order no sooner than November 7.

Read More

Nod to Energy in Obama's Speech Tonight? Maybe, Even If It's "Boring"

Energy independence has been a staple of American presidential politics since the early 1980s, a hot button issue that nevertheless hasn't triggered the vitriolic level of discord between the two parties typical of other important (and not so important) issues.  High-wire fights over drilling and cap-and-trade notwithstanding, both parties are generally rowing in the same direction on energy independence and efficiency.

Over the past month both parties have embraced the "all-of-the-above" approach, a pragmatic view of energy issues, recognizing that the shift to renewable energy will be a longer slog than optimists thought.  At  a panel during the Democratic National Convention yesterday, Howard Dean, former Democratic Governor of Vermont and a one-time presidential contender himself acknowledged what Democrats have reluctantly embraced:  The country and the economy is dependent on non-renewable energy sources and will be for a long time.   "We're going to need petroleum for the foreseeable future," Dean said.

Still, it's a good idea for the government to push the country in the direction of non-renewable energy as much as is practicable, Dean said.  "I do think there are some reasons to spread out the use of this stuff and to minimize carbon footprint."

One barrier to the shift to renewable energy sources, or to lowering energy consumption, is that to most consumers "energy is boring," according to Art Lasky, President and Founder of consumer energy management company Opower, speaking on a separate panel at the DNC yesterday.  Although "90% of people at this convention and elsewhere would say saving money is important...the only time you think about energy in the home is when the power is out," he said, noting that research shows the average customer spends only six minutes per year actively engaged with their energy utility.

If that's the case, will Obama push energy issues high on his reelection agenda and will we hear much about energy in tonight's speech?  According to some sources, Obama plans to promote his track record on energy issues tonight, pointing to reduced oil imports, improved vehicle efficiency and more renewable energy generation.

In his now-revered nominating speech, Bill Clinton mentioned but only touched on energy, praising Obama's all-of-the-above energy strategy.  It's possible that because both parties seem to agree on the big points, or that most people think the topic is boring, that energy isn't a big issue this election season that will sway voters one way or the other.

Read More

RuggedCom is the Tip of the Iceberg When It Comes to Vulnerable Power Grid Gear

As President Obama weighs the decision to issue an executive order following the failed Cyber Security Act of 2012, a security alert issued by an arm of the Department of Homeland Security (DHS) earlier this week cast a spotlight on the vulnerabilities of networking and other gear that make up the U.S. electric grid.

DHS warned that security researcher Justin Clarke of Cylance had discovered a vulnerability in Siemens-owned RuggedCom’s Rugged Operating System (ROS) which could decrypt secure traffic between RuggedCom networking equipment and end-users.  Reuters, which broke the news of Clarke's finding (his second discovery of a flaw in RuggedCom gear this year), characterized the flaw as "one that could enable hackers to attack power plants and other critical systems."

Although that contention is likely an overstatement, RuggedCom's networking gear, designed to withstand harsh environments, is indeed widely used by the nation's electric utilities to support communications to remote power stations and other mission-critical functions.  And RuggedCom's faulty security could be the tip of the iceberg when it comes to vulnerable equipment deployed by utilities.

What other vendors sell vulnerable gear to the energy industry and which vendor is likely to pop up next in a DHS alert?   "You could throw a dart at a dartboard with a list of a vendors and come up with the next one," according to Patrick Miller, President and CEO of EnergySec, an industry body focused on cyber security.

"But it's like a bell curve. Some are on the front end and are doing good things, there is a bunch in the middle and a lot of bad ones at the end," Miller said.  

In fact, there is less security testing of the components that make up the electric grid than there is for the switches, routers and other devices that make up the Internet. "If it's intended to go into a substation, depending on the type of device, there is a higher likelihood that it hasn't gone through the same security measures as have the devices that go on the Internet," according to Miller, who is also the Principal Investigator for the National Electric Cybersecurity Organization (NESCO).

Two big factors foster energy industry use of vulnerable gear.  First, secure devices are very expensive, requiring secure coding, secure supply chain procedures and other costly steps.  And state public utility commissions keep a tight rein on utility expenses, forcing utilities to cut costs at every corner.

Utility "profits are regulated.  Every step along the way in terms of expenses is regulated. Are ratepayers going to want to pay that?" Miller said.   "The commissioners pride themselves on making sure the expenditures are prudent. If it looks like you're gold-plating," they won't approve utility expenditures. 

Even if utilities were able to persuade regulators to sanction more expensive, more secure gear, any technology upgrade could trigger a chain reaction of additional costs, which would also have to be passed onto ratepayers.  "If you can economically support that kind of technology refresh, they may end up voiding the warranty on their multimillion dollar management system," because other components in the system won't have been tested and warranted for compatibility with the new gear.

If energy industry gear is so widely considered to be vulnerable (which several industry cyber security technologists have confirmed) and regulators won't allow utilities to raise rates to pay for better gear, what's the solution? 

"The solution is basically better architectures," Miller said. "You have to get past the mindset that the system is 100% secure" and instead work on ideas that teach utilities how to operate through an attack, how to operate through a vulnerable state.

Because no matter how secure or new the devices, energy sector companies will have to constantly battle device breaches from here on out.  "It's almost whack-a-mole," Miller said.  Technology breaches happen so regularly and so frequently that "there's another problem with the next device, another problem with the next device, another problem with the next device."

Image credit:  Siemens.

 

Read More