Expect national infrastructure attack, FIRST founder warns FIRST

Emergency response teams should expect "at least one concentrated attack on a critical national infrastructure system like power or water supply", the FIRST annual conference in Baltimore, USA

Emergency response teams should expect "at least one concentrated attack on a critical national infrastructure system like power or water supply", the FIRST annual conference in Baltimore, Maryland, USA was warned today [Wednesday, June 28].

In his keynote address to the conference Richard Pethia, one of FIRST’s founders, director of the Carnegie Mellon University Computer Emergency Response Team Co-ordination Centre, said that a high-level attack would happen "sooner or later."

He added: "I’m not saying whether or not the attack will succeed in crippling a national utility system, but I do believe it will certainly shake it up a lot."

Mr Pethia told FIRST (the Forum of Incident Response and Security Teams) of a world in which cyber criminals were becoming more sophisticated and more brutal, and alluding to yesterday’s conference talks on closer ties with law enforcers he said: "I think it’s time for us to get seriously connected with the law enforcement community. Attacks for profit will increase dramatically, and the people concerned aren’t going to worry about causing serious injury on the way."

Meanwhile there was a shift, he said, from wide-scale indiscriminate worm and virus attacks towards more specific victim-targeting. Whatever we did last year we’re going to have to change, because next year’s problems will be different.

"Systems will become ever more complex, continuously evolving and becoming bigger and more interdependent, and that means new vulnerabilities will open up." He predicted increasing dissatisfaction with perimeter security and intrusion detection systems, not least because "they don’t scale up to the size of the systems we envisage". Instead, he foresaw the emergence of "application-centric" security event detection.

Mr Pethia told delegates: “Some of the problems we have are rooted in system architecture and design. You people should let your voices be heard; tell the vendors: 'guys, you've got to do a better job. We need better systems with better security."

He added that it was important for security teams to get input to management about security and training: "we all know that some organisations are on top of security – and others are clueless."

He added that it was important for security teams to get input to management about security and training: "we all know that some organisations are on top of security – and others are clueless."More about the FIRST Baltimore Conference at
www.first.org/conference/2006More about FIRST at
http://www.first.org&http://www.first.org/about

Wed, 28 Jun 2006 16:36:00 +0000