Keeping cyberterrorists out of our ‘digital Pearl Harbors’

With America on the verge of experiencing a “digital Pearl Harbor” and Israel facing daily attempts to destroy its infrastructure – as described by US Defense Secretary Leon Panetta and Prime Minister Benjamin Netanyahu described in separate speeches in recent days – it’s just a matter of time before cyberterrorists are able to reach a critical target: the systems that control basic infrastructure.

But protecting infrastructure networks isn’t the same as protecting your home computer. The networks that connect infrastructure rely on Ethernet switches, sometimes thousands of them, connecting them to a network, all in the field, where they operate under sometimes adverse conditions. They also function unsupervised, and as such constitute an Achilles heel of modern society.

There is a great deal to worry about, security experts say. According to Pike Research, a division of infrastructure security consultants Navigant, “utility cyber security is in a state of near chaos.” In a 2011 report, the group said that “after years of vendors selling point solutions, utilities investing in compliance minimums rather than full security, and attackers having nearly free rein, the attackers clearly have the upper hand. Many attacks simply cannot be defended.”

McAfee Labs, the computer security firm, placed cyberattacks against utilities at the top of its list of “threat predictions” for 2012, saying in a report that many water, electricity, oil and gas systems “are not prepared for cyberattacks” and “don’t have stringent security practices. Attackers will continue to leverage this lack of preparedness, if only for blackmail or extortion.”

The Stuxnet virus, which wreaked havoc earlier this year with computers throughout the Middle East, is just the leading edge of viruses directed at infrastructure, according to Intelligent Utility magazine. The virus, which attacked industrial control systems (SCADA) made by Siemens, is the coming to life of “a real scenario that sends chills down the spines of electric utility operators,” the magazine said.

These were among the specific threats that Panetta and Netanyahu addressed in their speeches. “An aggressor nation or extremist group could gain control of critical switches and derail passenger trains, or trains loaded with lethal chemicals,” said Panetta. “They could contaminate the water supply in major cities, or shut down the power grid across large parts of the country. The most destructive scenarios involve cyber actors launching several attacks on our critical infrastructure at once, in combination with a physical attack on our country.” Netanyahu, too, discussed the never-ending attempts by hackers to break into Israeli sites, saying that the only option for Israel was construction of an “Iron Dome” against cyber-attacks, “just as we have the Iron Dome against missiles and the security fence against infiltrators and terrorism.

The situation is critical, according to Ilan Barda, CEO of RADiFlow, and utility operators are beginning to get the message. “Secure networking for critical infrastructure is essential, and there is a great deal of opportunity in smart apps for utilities, transportation, and safe city installations.” Speaking at the annual conference of RAD Group partners being held in Eilat this week, Barda said that managers in all these market segments were seeking solutions that could be implemented quickly and efficiently. “It’s a huge market, and a great opportunity,” he added.

RADiFlow is the newest member of the RAD Group, the conglomerate of cooperating independent companies that make up Israel’s largest telecommunication hardware and software solutions provider. There are currently 13 members in the RAD Group, six of which are traded on the NASDAQ, and over the years, since it was established in 1973 (with the first RAD company, Bynet), the group has spun off or sold at least a dozen companies, gaining the reputation as Israel’s original “Start-Up Factory.”

One of the advantages of being part of a large group is the ability to leverage the experience, products, and guidance of other members, and RADiFlow has developed products based on its own R&D, as well as on the R&D of its RAD Group partners, including RAD Data Communications, which specializes in solutions for phone carriers, and, increasingly, utilities. “A lot of utilities want to, and need to, modernize their communications and networks, especially in order to work with smart grids” — systems that let utilities keep an eye on customer usage levels, allowing them to more efficiently deploy precious resources, said Dror Bin, RAD Data’s CEO.

In order to install smart grids, however, utilities need to modernize their networks, relying on Internet-style packet transmission. But, as anyone whose website or computer has ever been hacked can attest, packet networks are less secure than the legacy, dedicated networks most utilities now use. “Utilities are conservative, and with good reason,” Bin told the Times of Israel. “Any upgrades have to bulletproof. It is only very recently that utility managers have come to the conclusion that security applications on packet networks are mature enough to allow them to consider upgrading.”

In several of its networking products, said Bin, the company is embedding security systems into Ethernet switches, along with sophisticated software that allows for full control over the network. RADiFlow is offering similar technology in the products it produces for utilities and transportation systems. “We provide ruggedized network switches, small devices in thousands of locations. Instead of being unsupervised and vulnerable, they are under complete control of administrators, with security embedded into the device,” said Barda. Among the security measures are encryption SSH, and strong firewalls, as well as inspection of all traffic to ensure that it fits the expected profile (based on preset rules), and alerting administrators to abnormal application behavior — thus preventing a hack attack from the outside, or an “insider attack” from someone with permitted access to equipment.

There is a lot of competition in this area, said Barda, but few, if any, of RADiFlow’s competitors can offer the integrated solutions of his company’s products. “We are not going to compete with anyone on price, but on quality and capability, and we know our products are faster, easier to use and deploy, and offer a greater degree of security,” he said.

During the two or so years it has been selling systems, RADiFlow has installed security equipment for utilities and transportation systems (subways, buses, and commuter trains) throughout Europe, with some activity in South America, Canada, and New Zealand – and of course, Israel, where it has worked on several Safe Cities projects. Barda plans to greatly expand the company’s sales efforts in 2013. “It’s a matter of explaining what cybersecurity is all about to the customers we deal with, and why we are better at it than others,” said Barda. “There is plenty of work to be done.”