Privatised utility companies exposed to cyber attacks

The studies, by the US Center for International and Strategic Studies and the UK's Cyber Security Research Institute, warn that equipment used to control the  critical national infrastructure (CNI) in the US and the UK is lagging behind the IT world in terms of computer security, and that connecting those systems to the internet has left them wide open to a cyber attack.

Last year Iran admitted that one of its nuclear installations had been damaged by a computer virus called Stuxnet.

In the recent Defence Review the British Government set aside £650m to deal with cyber issues including improving the CNI.

But Pete Warren from the CSRI said: "There is nonetheless little awareness of the scale of the problem involved. Computer chips control systems in every conceivable part of our lives ranging from cars and traffic lights, buildings, air-conditioning in data centres, lifts and transport networks."

One expert quoted in the CSRI report said: "The pot of money that the Government has allocated to this is not big enough to protect its own critical infrastructure let alone research the national critical national infrastructure to find out what needs to be done."

According to the CSIS study, commissioned by the computer security company McAfee, and which surveyed 200 companies from around the world including the UK, the electricity industry is particularly prone to a cyber attack.

In this report the UK lagged at the bottom of the table for Government security audits.

The CSIS report also pointed out that the vulnerability was particularly worrying because of an increasing level of cyber attacks which are either aimed at extorting money from companies or using cyber espionage to steal information, and because of plans in the US and Europe to introduce new smart grid technology which will allow homes to generate electricity for the grid.

According to Jim Woolsey, former United States Director of Central Intelligence, "90-95% of the people working on the smart grid are not concerned about security and only see it as a last box they have to check.'

This point is underlined by one executive in the CSIS report who lashed out at the thinking behind smart grid plans, citing "the dumbness of 'let's put every household's power supply on the Internet - and call it smart'!"

The UK's CSRI report says that security has not been a high priority in the control system industry because staff are picked according to their ability to respond rapidly to potentially dangerous situations rather than how to keep them secure from criminals and terrorists and as a result that CNI security is 10-15 years behind that of IT systems.

"I have assessed 40-50 jobs in the last three months and not a single one mentions security," the report quotes one senior industry consultant.

The situation has been made worse by a chronic skills shortages and underinvestment, particularly in the privatised utility industry.

"The situation is worsening rather than improving. The mix of the people with the industrial systems knowledge and the security skills isn't there," commented one contributor to the report.

"Ensuring that the UK's critical infrastructure, vital government networks and services are appropriately secure and remain resilient from electronic attack is a central pillar of the National Cyber Security Programme (NCSP) which will be implemented over the next 4 years utilising the additional £650m funding allocated to cyber under the Strategic Defence & Security Review," said a spokesman for the Cabinet Office.

"This new funding is in addition to the resource allocated to network security in existing departmental budgets."