## 8 Cyber-Defense  
Stuxnet damaged the centrifuges at Natanz by reprogramming the Siemens PLC that controlled them. To do that, it had to first compromise a Microsoft windows system, and then the Siemens WinCC/PCS 7 SCADA control software running on it. This was accomplished by exploiting several vulnerabilities, one of which was a hardcoded WinCC/SCADA password that had been posted on the Internet. Recently, the Rugged Operating System, which runs RuggedCom switches and servers on the communications networks of power grids and other critical infrastructures, was reported to have a similar backdoor with hardcoded password. In this case, the password used with a particular device was unique. However, if an adversary was able to acquire the device's MAC address, say through the Shodan search facility, then the password could be computed by plugging the MAC address into a Perl script [31]. To defend against the likes of Stuxnet and other ICS cyber-attacks, the operators and vendors of ICSs need to do better. There is no excuse in today's threat environment for posting passwords on the Internet or using ones that an adversary can easily determine. Given the extensive attention Stuxnet received in the press, including reports of vulnerabilities in the ICSs running critical infrastructures and the harm that could result from ICS cyber-attacks, Stuxnet could serve as a motivator to governments and industry worldwide to initiate or accelerate efforts to enhance infrastructure security. In the remainder of this section, I will focus on US efforts in ICS cyber-security and Stuxnet's impact on these efforts. I make no claims about Stuxnet's impact in other countries, especially Iran, where its effects were much more significant. Within the United States, the vulnerabilities of ICSs were recognized long before Stuxnet, with efforts to address them dating back to at least 1996 when President [PERSON] established the President's Commission on Critical Infrastructure Protection (PCCIP). The commission's report, issued in 1997, led to the creation of several government offices and to industry-centered information sharing and analysis centers for promoting cyber and critical infrastructure security [32]. Since then, but also before Stuxnet was reported in the press, the US government took several additional steps to strengthen cyber-defenses, including:  
* Creation of the office of Cyber Security and Communications (CS & C) in the National Protection and Programs Directorate (NPPD) of the Department of Homeland Security (DHS). This office also includes the National Cybersecurity and Communications Integration Center (NCCIC) mentioned previously, the National Cyber Security Division, and the US-CERT. * Appointment of a cyber-security coordinator in the White House. * Issuance of the National Strategy to Secure Cyberspace (NSSC) [33]. * Issuance of the Comprehensive National Cybersecurity Initiative (CNCI) [34]. * Issuance of the Strategy for Securing Control Systems (SSCS) [35]. * Formation of US Cyber Command. While most of these initiatives go well beyond ICS security, they also recognize the problems in this area. The NSSC states that the security of digital control systems and SCADA systems is a national priority, and that DHS will work with other concerned agencies and the private sector to increase the security of these systems. The twelfth initiative of the CNCI explicitly addresses cyber-security for critical infrastructures, calling for an approach that \"builds on the existing and ongoing partnership between the Federal Government and public and private sector owners and operators of critical infrastructures and key resources.\" And, of course, the SSCS is devoted entirely to control systems. It includes the establishment of the Industrial Control Systems Joint Working Group and an expanded ICS Cyber Emergency Response Team (ICS-CERT). In addition to these initiatives, several legislative proposals to strengthen cyber-security were introduced prior to Stuxnet's public disclosure.