Online threats continue to outpace government and industry’s ability to respond

Online threats to the world’s critical infrastructure continue to grow, according to a new report released today, but bureaucracy and distrust continue to hamper the public-private cooperation that everyone agrees is necessary to counter the threats.

The private sector owns and operates the vast majority of the systems on which the world depends, from the Internet to transportation, power distribution and water treatment systems. But the government has intelligence data and the authority to regulate, and the two sides seem to be as far apart as ever in forming an effective partnership.

“Without working in concert with the private sector, it will be difficult for government to achieve anything,” said Asha Mathew, a senior counsel on the Senate Homeland Security and Governmental Affairs Committee.

“There is a lot of technology that can solve the problem now,” said Phyllis Schneck, director of threat intelligence for the Americas for McAfee Inc., which commissioned the study. The company can monitor traffic and attacks with great granularity, but the intelligence data and policy to use that technology is lacking. “The bad guys are wining the war, because they don’t have to have a meeting to do things.”

The comments were made during a panel discussion in Washington on the release of the report, “In the Crossfire: Critical Infrastructure in the Age of Cyber War,” which was created for McAfee by the Center for Strategic and International Studies (CSIS). The study is based on detailed surveys of 600 security professionals in 14 countries and was touted as the most complete to date of the security posture of the global critical infrastructure. One industry representative called the findings “troubling, but not surprising.” The report can be downloaded here (registration required).

The study found that 60 percent of those interviewed had experienced theft-of-service attacks and nearly 90 percent were infected by viruses or other malicious code. Twenty percent said they had been victims of cyber extortion attempts, although that number was only 12 percent for the United States, compared with 40 percent in India.

Defenses mounted against these threats appeared to be inadequate.

“I would describe preparedness as spotty, and in some cases quite lacking” said Stewart Baker, a visiting fellow at CSIS and leader of the team that wrote the report. About 40 percent said they were not well-prepared or not prepared at all to counter threats, about the same percentage that does not regularly patch and update software.

“They don’t have much faith in the ability of government to stop the attacks,” Baker said. In the United States, 48 percent said U.S. laws are inadequate to protect against attacks.

On the other side, government is dissatisfied with the level of cooperation offered by the private sector. “That has always been a sore point with government,” said Baker, a former assistant secretary for policy at the Homeland Security Department.

Companies often are reluctant to share detailed information with government in this country because of the possibility that the information could be misused or made public. On the other hand, the private sector complained that the government is not forthcoming with the information it has. One representative of the oil and gas industry said that even information given in classified briefings is old news and of questionable value.

DHS representatives expressed the need and their willingness to work with the private sector.

“Security is obviously a shared responsibility,” said Sue Armstrong, DHS deputy assistant secretary for infrastructure protection. She said a national incident response plan is in the works to help coordinate government and industry response, and the metrics must be developed to measure the effectiveness of incident response. “Verification is the next step in the dealings between government and industry.”

But Adam Rice, global chief security officer at Tata Communications, a Tier 1 Internet carrier, said that he has not been able to get actionable information from government organizations, including DHS and the FBI.

“We smile at each other, but I don’t take anything away from the meetings that are helpful in protecting the infrastructure,” Rice said.

He said companies that operate the Internet core have the ability to observe traffic patterns around the world, but that threat information from government, required to use that technology effectively, is lacking. “Government needs to be in the business of being more proactive.”

“Perhaps the pain isn’t great enough yet” for forced cooperation, Rice said.

That pain might be coming. One hundred percent of those interviewed in the study said they expected a serious international incident caused by online attacks, possibly involving the loss of life, to occur within the next five years.