Cyber security has become a major threat to global infrastructure and economy. We've seen malware designed to spy on and subvert industrial systems at Iran's Natanz nuclear facility, a destructive Trojan horse disable thousands of computers at Saudi Aramco and the US Defense Secretary warning that the US could face a "cyber Pearl Harbor" following the crippling of US bank websites. The tide of increasingly sophisticated and potentially destructive attacks is rising. The possibilities are chilling.
The problem is that operational technology is the bedrock of every industry and fundamentally underpins our critical infrastructure. It is so widespread it controls everything from oil plants to nuclear reactors, power grids and banking systems.
So much critical infrastructure is vulnerable. Oil pipelines can be turned off and the pressure in nuclear plants turned up. Hackers can use any number of entry points to breach IT systems and, once inside, can access servers, databases and operational equipment.
More recently, a diplomatic time bomb was uncovered, which illustrates how cunning this activity has become. Dubbed Red October, this subterranean stalker has been stealthily stealing emails and other encrypted classified documents from diplomats for about five years. It has infected at least 350 government organisations around the world, especially in the former Soviet republics.
It attacks with chilling surgical precision. It consists of about 1,000 different modules, the programming style of which suggests many different authors, ranging from the sophisticated to the simple. It's hard to escape the conclusion that Red October was commissioned by an intelligence service. And, it wasn't picked up by traditional security software. It avoided anti-virus detection and was discovered only when an informant handed a file containing the malware to a researcher.
The invisibility of attacks
Every so often, the sophistication of threats increases. One particular cunning technique is known as reflective memory injections. In essence, it doesn't leave a file on a computer drive as traditional malware does. Rather, it inserts itself into a computer's memory. And, once something is loaded into a computer memory, it's considered by the system to be trustworthy and can then send instructions to disable systems or cause havoc.
You can see the danger, and while the sophistication of this technique is enhanced, the threat is not unusual. Over the past 25 years, of the 54,000 software vulnerabilities given a severity rating by the industry neutral Common Vulnerability Scoring System, about 14% were memory-based attacks.
While sophisticated memory injections have been notoriously difficult to detect, they can be halted by technology that monitors an endpoint's memory address space and associated processes for distinct evidence of exploitation. If an executable library is found, an event is generated and the injected process is terminated. But, that is just one opportunity to halt malware from executing. The malware will have already overcome other defence obstacles to get to this point. To have any real chance of halting such an attack, security technologies need to work in tandem.
It's a bit like a castle of old, with a water moat, thick stone walls, a drawbridge, inner sanctuary and an army of soldiers checking that everyone is who they say they are. In case the outer walls were breached without anyone noticing, the army of soldiers would point out and terminate the assailant in the inner sanctuary.
Battening down the hatches
Defending the UK infrastructure isn't going to be easy. Britain is being targeted by up to 1,000 cyber attacks every hour in a bid to steal its secrets or disable systems. So, are we sitting idly waiting to be attacked? Of course not. There is a work going on quietly. There has been the formation the Cyber Security Information Sharing Partnership (CISP), which has brought together intelligence services and private sector computer security experts to work against the wave of cyber crime and espionage against British companies. Not to mention the Strategic Defence and Security Review allocating £650m in 2010 to strengthen the UK's cyber capacity. The UK's GCHQ has also placed urgent focus on protecting cyber space.
These efforts are all very much welcomed, but there certainly needs to be an increased urgency to protect our entire national critical infrastructure. After all, the nature of threats means that malware could already be hibernating in some critical infrastructure, primed to wreak damage at a given date.
Alan Bentley is senior vice-president worldwide at Lumension