John Dickson answers the question “As a security guy, what industries scare you most?”
The reason the security of our healthcare and electrical power industries scares me is not just the impact, but how consistently ill-prepared both industries are to defend against sophisticated attacks. I say this as a 20-year security consultant who has worked in four different companies and delivered hundreds of security assessments, penetration tests, and other projects.
...But what scares me the most are four significant mismatches between the sophisticated attackers and defenders in both industries:
#1 Closed systems
Both industries have huge initiatives that will transform their respective industries and change their risk profiles. Smart meters are being adopted to optimize electrical distribution and manage peak demand. This means they are taking a previously closed electrical distribution system and connecting it to the Internet. Unfortunately, there’s a culture clash between the Internet and electrical distribution worlds...
#2 A false sense of security
These industries view many cyber security threats in the abstract. There are no Targets or Home Depots in either industry, and arguably (at least as far as we know), sophisticated attackers are not attacking them. They’ve not had any near-death experiences, and because of the abstract nature of cyber security threats, leadership does not worrying about attacks, and security budgets suffer. No daily threat of stolen money equals a false sense of security.
#3 Unfamiliar adversaries
Governmental organizations are used to getting attacked by nation states. Financial services companies are battling organized crime hacking syndicates who are both savvy and sophisticated. In the electrical and healthcare sectors, the likely adversaries will be nation states as part of a larger international crisis, or Eastern European hackers, when they find out how to monetize either target.
#4 Too much vendor trust
Both industries have a common denominator: highly trusted relationships with large systems and product vendors. But because they have worked so closely for a long time, they rarely question whether these partners conducted adequate security testing of their products or networks beyond simple vendor checklists. In the IT world, security leaders ALWAYS question vendor claims. In contrast, certain medical and electrical distribution products provide vendor lock-in and a client mismatch of power. Witness the many medical devices still running on Windows XP.