The Power System Malware Problem, and a 'Perfect' Solution

Published: August 17, 2010

by Alex Woodie

Security products vendor BrickHouse Security issued a warning last week over the malware that foreign computer hackers have placed in critical American industrial components using the Internet. The good news is that the security infiltration has to do with electrical power systems, not the IBM Power Systems servers that run a good chunk of midsize American businesses. The bad news is that bad guys may now have the ability to take everything off line, including your Power Systems servers and the Internet connections that feed them.

The Wall Street Journal sparked concern across the country with an April report about how Russians and Chinese spies hacked into the American electrical grid in an attempt to map it (apparently, they couldn't wait for the July 2010 National Geographic map of the three interconnected national grids). The WSJ reports that American intelligence officials detected Trojan Horses left behind by the spies that could be used to damage the grid and, by connection, network communications.

BrickHouse blogger Stan Shyshkin warns that new "smart grid" technology could make the problem worse. IBM is a big proponent of smart grids, in which sensors are implemented at end points to create a demand feedback loop, thereby lowering power consumption and boosting grid efficiency. "Transforming a largely one-way distribution network like the power grid into a two-way system that sends and receives information from consumers gives the hackers additional entrances into the grid," Shyshkin writes.

The National Security Agency (NSA) has stepped up to the plate and is promising to crack down on the security vulnerability with a new program called Perfect Citizen. Unveiled last month, the new program involves installing sensors at companies and organizations that are involved with running the power grid and other critical infrastructure components.

Perfect Citizen also involves patching the weak links in the grid, such as the end-point sensors in the new smart grids, or "smart meters," which are based on common off-the-shelf components that hackers could easily deconstruct. Defense contractor Raytheon reportedly has the first Perfect Citizen contract. It's hard to imagine how IBM, whose experts and technology are involved with counter-terrorism, is not somehow involved with Perfect Citizen.

The takeaway for Power Systems shops is to realize that threats to security and business continuity today come in many shapes and sizes. Not only must Power Systems shops worry about tornadoes, earthquakes, disgruntled employees, and computer hackers, but now they must consider the ramifications of a greater likelihood of disruptions in access to electricity and network bandwidth. (Malware, ironically, is one of the least of Power Systems shops' concerns.)

Granted, if the Western electrical grid is taken offline by hackers, there will be much greater problems for society than companies being unable to access their IBM i applications. Nuclear power plants would be damaged, financial networks would be taken offline, dams would be opened up, and sewage would back up. Even Facebook and Twitter would be effected.

But as the old saying goes, forewarned is forearmed. Perhaps now is a good time to review your disaster recovery plan, make sure the UPS is functioning properly, and check that there's plenty of diesel for the generator.

                     Post this story to del.icio.us
               Post this story to Digg
    Post this story to Slashdot