This report addresses the cyber-vulnerability of critical infrastructure industries which regularlyuse industrial control systems. Industrial control systems may be vulnerable to infiltration bydifferent routes, including wireless transmission, direct access to control system computers,exploitation of dial-up modems used for maintenance, or through the Internet. This report willspecifically discuss the potential for access to industrial control systems through the Internet. The vulnerability of U.S. critical infrastructure to cyber-attack and catastrophic failure was brought to light in 1997 in the report of the President's Commission on Critical InfrastructureProtection. (1) Among other concerns, the computersystems used to remotely control processequipment were highlighted as specific points of vulnerability. These systems were updated duringthe Y2K crisis, but their cyber-security generally has not been a high priority. The events ofSeptember 11, 2001 have heightened the public awareness of the nation's vulnerability to terroristattack, and a National Research Council report has identified "the potential for attack on controlsystems" as requiring "urgent attention." (2) Critical infrastructure is defined in the USA PATRIOT Act as those "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of suchsystems and assets would have a debilitating impact on security, national economic security, nationalpublic health or safety, or any combination of those matters." (3) Several industry sectors consideredto be critical infrastructures use industrial control systems in their daily activities. These industriescould be significantly affected by a cyber-attack targeting industrial control systems such assupervisory control and data acquisition (SCADA) systems, distributed control systems, and others. The President's Commission on Critical Infrastructure Protection report stated, From the cyber perspective, SCADA systems offer some of the most attractive targets to disgruntled insiders and saboteurs intent on triggering a catastrophicevent. With the exponential growth of information system networks that interconnect the business,administrative, and operational systems, significant disruption would result if an intruder were ableto access a SCADA system and modify the data used for operational decisions, or modify programsthat control critical industry equipment or the data reported to controlcenters. (4) The most commonly discussed industrial control systems include supervisory control and dataacquisition (SCADA) systems and distributed control systems (DCS). (5) SCADA systems are oftenused for remote monitoring over a large geographic area and to transmit commands to remote assets,such as valves and switches. For example, they can be found in water utilities and oil pipelines,where they monitor flow rates and pressures. Based on the data that these systems provide, computerprograms or operators at a central control center balance the flow of material. Generally, SCADAsystems process little data internally, instead performing analysis in a more central location, but arethe primary conduits for raw data to and commands from a control center. They may be vulnerableto implantation of faulty data and to remote access through dial-up modems used for maintenance. Distributed control systems are process control systems, commonly deployed in a single manufacturing or production complex, characterized by a network of computers. DCS generallyprovide processed information to, or a series of commands from, a central location. For example,at a chemical plant, a DCS might simultaneously monitor the temperature of a series of reactors andcontrol the rate at which reactants are mixed together, while performing real time processoptimization and reporting the progress of the reaction. An attack targeting a DCS might causeextensive damage at a single facility, but might not affect more than the single site. These process control systems can be interconnected within a single industry as well. This might be the case in an infrastructure which both transports and processes material. As an example,the oil and gas infrastructures contain both processing and refining sites, as well as holding facilitiesand distribution systems. Refining and processing sites may utilize DCS in discrete locations. Thedistribution and holding facilities might be managed by a SCADA system which collected data fromand issued commands to different geographic sites from a single location. (6) Industrial control system technologies are often employed in critical infrastructure industries to allow a single control center to manage multiple sites. Industrial control systems were originallyimplemented as isolated, separate networks. (7) Theywere viewed as secure systems which protectedremote locations from being physically broken into and mistreated. For example, the establishmentof remote control systems in dams reportedly protected against unlawful release of the dammedwater, as no hand-operable valves and switches were accessible. (8) The networking of industrial control systems on a greater scale has led to increased synergy and efficiency, and, due to market needs (e.g. deregulated markets), real time information from thesesystems is increasingly important for commercial purposes. Consequently, industrial control systemsare becoming linked to corporate computer systems, potentially making them vulnerable to cyber-attack throughthe Internet. Original control systems were designed to be free standing networkswithout Internet access. Therefore, it has been necessary to add network access capabilities to theselegacy systems to integrate them into the corporate structure. This has created, in the worst cases,a labyrinth of connections which is perhaps not rigorously constructed for cyber-security or welldocumented. Many organizations, including the General Accounting Office, researchers at several Department of Energy National Laboratories, and private security and consulting companies, haveidentified systemic and specific security vulnerabilities in select process control systems. (9) Amongthese vulnerabilities are poor cyber-security practices, such as weak passwords, a lack of robustprotocols, and communication in clear text. While some vulnerabilities arise from the manner bywhich the process control system is operated, others are believed to be integral to the control systemconfiguration itself. Some industrial control systems, including legacy systems, are proprietary, and contain non-standard architectures and command syntax. This can be considered both an advantage and adisadvantage. Proprietary systems with esoteric command structures are often non-intuitive, andcould be difficult to operate by an untrained individual. Incorrect commands could cause no results,and may increase the probability that the intruder would be noticed and removed from the system.Additionally, different companies may have different command sets, even if they are both membersof the same industry, as their proprietary systems may have significantly different structures. Thus,if a hacker or terrorist successfully attacks one company, that experience may not be valuable for useat the next company. Others assert that many new control systems, as well as upgrades to legacysystems, are being assembled from commercial, off-the-shelf equipment and software, providingcommonalities across different industry sectors. They point to the needs of system maintenance andnew component integration as leading to similar control system architectures both within andbetween critical infrastructure sectors. By adopting such equipment and software, vulnerabilities thatare identified impact all sectors. The degree of integration between control system networks and publicly accessible networks is difficult to judge from the open literature. This makes assessment of the vulnerability of criticalinfrastructure industries from Internet based attack difficult to know with certainty. (10) Faced with anunclear risk, it may be difficult, from an industry perspective, to justify the additional costs ofupgrading privately-held industrial control systems to higher security standards. (11) Current off-the-shelf industrial control systems have been designed foroperational speed and functionality, ratherthan for secure operation, and therefore may not have a high degree of operational security. (12) Addition of security requirements may degrade the performance of these components belowoperating standards. Events have shown that utility control system networks may be vulnerable to cyber-based incidents. Computers at an inactive nuclear power plant in Ohio were infected by the Slammerworm in January 2003. The infection disabled some computer functionality, including monitoringsystems for portions of the power plant. (13) Also,it has been reported that other control systemcomputers have been compromised by other viruses. (14) Given the uncertain vulnerability level and the potential systemic weaknesses involved in current off-the-shelf technology, there appears to be little market incentive to directly increaseindustrial control systems security. Therefore the security systems for the corporate network, whichblock initial intrusion through the Internet, may be the sole planned protection for the industrialcontrol systems. Such an approach has been criticized, as while it may provide initial barriers tointrusion, it would not reduce any inherent vulnerabilities in the control system network. (15) Security analysts also contend that industrial control systems are less obscure now than when they were initially developed. Foreign utility companies increasingly use current commercial off-the-shelf industrialcontrol systems, increasing the international availability of systems and theirdocumentation. Due to the similarity between these systems and systems installed domestically,potential terrorists need not break into an American utility to test their plans. (16) Instead, preliminarytesting might be performed outside of the United States on equipment held in other countries. Some security analysts believe that the industrial control system vulnerability should be addressed before potentially catastrophic events occur, and that techniques for reducing thevulnerability are already known. They contend that the majority of attacks on industrial controlsystems will come through corporate networks, via the Internet. While standardized informationtechnology protection methods have not yet been developed specifically for industrial controlsystems, these analysts contend that if general network benchmark standards were uniformly appliedacross corporate networks, corporate networks vulnerability to intrusion could be reduced by 80-88%. (17) This would indirectly reduce the industrial controlsystems vulnerability to intrusion, asroutes through the corporate network would no longer be available. These benchmark standardsinclude disabling unneeded server functionality, patching known security flaws, and updatingprograms to the most recent version. Other security analysts claim that in addition to general network security, specific protection for industrial control systems must also be established. Such protection might be addressed bysuccessfully isolating the control system network from the corporate computer network or byimplementing stronger security measures at known junctions of the two networks. Such an effortmight significantly increase the difficulty of infiltrating the control system network from theInternet. (18) In contrast, control systems may have vulnerabilities unrelated to those associated with corporate networks, and may require more specific protection, including against attacks not transitingthe corporate network. (19) Protecting corporatenetworks from intrusion may not address enough ofthe vulnerable access routes into industrial control systems. Joe Weiss, Executive Consultant withKEMA Consulting, asserts that firewalls, intrusion detection, encryption, and other technology needto be developed specifically for control systems. (20) Some companies have taken aggressive steps to protect their industrial control systems, and arepossible examples for how secure industrial control systems can be established. (21) While mostsecurity experts agree that critical infrastructure industries which view secure industrial controlsystems as a priority can reduce vulnerabilities, some assert that most critical infrastructure industriesare not willing to voluntarily commit resources, time and effort into reducing these vulnerabilities. Stuart McClure, President and Chief Technical Officer of the security company Foundstone, claims,"[Industries] have fallen into the regulation trap. Unless the government regulates it, they're not yettaking [security] seriously." (22) Some critical infrastructure industry representatives are skeptical that a cyber-terror attackwould target industrial control systems. (23) Sincethere are no reported terrorist cyber-attacks ondomestic critical infrastructure industrial control systems which have caused significant, publiclyreported damage, even in cases where hackers have successfully broken into these systems, industryrepresentatives believe the cyber-threat to be low. Diane Van de Hei, executive director of theAssociation of Metropolitan Water Agencies and contact person for the water utility InformationSharing and Analysis Center (ISAC), was quoted as saying, "If we had so many dollars to spend ona water system, most of it would go to physical security." (24) Analysts have also doubted that terrorist groups will use cyber-attacks to affect critical infrastructure. They point to the lack of documented terrorism-related cyber-attacks on criticalinfrastructure as indicative of low threat probability. "It suggests that, as so many commentatorshave noted, that cyberterror or cyberattacks on infrastructure are an unlikely threat to the security ofthe United States." (25) Some critical infrastructure companies believe that the potential damage likely to be caused by a cyber-attack on control systems would be small and manageable through already existingprocedures. Since fluctuations and equipment failure are part of expected, normal business, plansand procedures for these naturally occurring events are in place. They assert that the damage causedby cyber-attack would be similar to that already routinely seen. (26) Some industry representatives emphasize that the unfamiliar and uncommon commands used in legacy industrial control systems will continue to provide as high a barrier to future destructiveattempts as it has in the past. (27) While utilityindustry leaders agree that they have been the target ofmillions of cyber-security incidents, some do not analyze the origin or method of attack. Will Evans,vice president of IT services at People's Energy Corp., reportedly claimed, "[A large utility] couldhave a million [intrusion] events that need to be analyzed. I don't think anybody has the capabilityto do that in-house." Utility industry representatives contend that the vast majority of computer intrusion events are searches for vulnerable computers in the corporate network by inexperienced hackers, and, of thedangerous minority actually performed by experienced crackers, many are focused on economicaspects of the corporate network rather than the industrial control systems network. (28) From theperspective of critical infrastructure industries, discontented employees who possess insideinformation about industrial control systems are a greater security risk than external attempts tobreach security. There is evidence that al Qaeda is interested in the vulnerabilities of the U.S. public and private utilities. The discovery in Afghanistan of a computer containing structural analysis programs fordams, combined with an increase in Web traffic relating to SCADA systems, (29) prompted theNational Infrastructure Protection Center (NIPC) to issue a warning information bulletin. (30) Ananalysis of cyber-attack data collected during the second half of 2001 showed that the corporatesystems of energy industry companies are attacked twice as often as other industries, and that a largenumber of these attacks originate from the Middle East. (31) Additionally, according to one expert,these statistics do not reflect intrusions directed at control systems which lack firewalls or intrusiondetection systems, resulting in an under-reporting of the actual number of attacks. (32) There have been examples of individuals specifically breaking into utility companies' control systems. The most notable event occurred in Maroochy Shire, Australia, where, in Spring, 2000, adiscontented former employee was able to remotely access the controls of a sewage plant anddischarge approximately 264,000 gallons of untreated sewage into the local environment. (33) In 1994,a hacker successfully broke into the computer system of the Salt River Project in Arizona and wasable to gain access to computers monitoring canals. (34) Another example, from March, 1997, occurredwhen a teenager in Worcester, MA was able to remotely disable part of the public telephoneswitching network, disrupting telephone service for 600 residents, including the fire department, andcausing a malfunction at the local regional airport. (35) Reportedly, an intrusion into the SCADAsystems of a global chemical company occurred where a former employee attempted to disablechemical operating systems at a production plant. (36) Often, it is difficult to assess from public reports to what degree a critical infrastructure industry has been breached. (37) For example, acyber-break-in at the California Independent System Operator(Cal-ISO), California's primary electric power grid operator, went undetected for 17 days in April,2001. Greg Fishman, a representative of Cal-ISO, reported the intruders "never really got close atall to our operational systems that run the grid." (38) It is not clear what information was compromisedduring the intrusion, who the perpetrators were, or what their goal in gaining access was. To date,there has been no indication that the perpetrators of this attack were able to access any sensitiveinformation or systems. The consequences of an attack on the industrial control systems of critical infrastructure couldvary widely. It is commonly assumed that a successful cyber-attack would cause few, if any,casualties, but might result in loss of infrastructure service while control was wrested from theattacker and damage repaired. For example, a successful cyber-attack on the public telephoneswitching network might deprive customers of telephone service while technicians reset and repairedthe switching network. An attack on a chemical or liquid natural gas facility's control systems mightlead to more widespread physical damage. Lower probability events include catastrophic infrastructure failure, where the failure of one part of the infrastructure leads to the failure of other parts, causing widespread effect. Such failuremight occur due to the synergistic effect of infrastructure industries on each other. A simple examplemight be an attack on electrical utilities where electricity distribution was disrupted; sewagetreatment plants and waterworks could also fail, as perhaps the turbines and other electricalapparatuses in these facilities shut down. On August 5, 2002, the faulty closure of an emergencyvalve at one of Singapore's two natural gas suppliers blocked the flow of natural gas to sevenelectrical power plants. As an immediate result, power levels dropped 30%, and even after reservepower was employed, there was still a 8% shortfall. The power outage lasted up to 90 minutes. (39) Several chemical production plants were forced to shutdown their facilities during the power outage,and required several days to restore full production. (40) Some experts warn of a cascade event, where a terrorist is able to manipulate control systems and cause catastrophic failure within an infrastructure. Cascade events can be very damaging,causing widespread utility outages. Twice in 1996, arcing between high voltage transmission linesand trees resulted in widespread power outages. On July 2, 1996, a cascade event left 2 millioncustomers in 11 states and 2 Canadian provinces without power. (41) Most service was restored within30 minutes. (42) On August 10, 1996, a similar eventcaused 7.5 million customers in seven westernstates and part of Canada to be without power for up to nine hours. (43) The August 2003 blackout of the northeastern United States and parts of Canada, also a cascade event, has been invoked as indicative of the potential effects a successful terrorist cyber-attack onelectrical utility control systems. (44) While it wasquickly determined that the power outage was notcaused by terrorism, (45) there were questionswhether control system failure, computer viruses orworms, or operator-error played roles in the outage. (46) It has been suggested by some that the Blasterworm, which had been contributing to congestion of the Internet, might have exacerbated theproblems faced by utilities leading up to the blackout event. (47) The scenario which causes the highest degree of concern among experts is the combined use of a cyber-attack on critical infrastructure in conjunction with a physical attack. (48) This use of cyber-terrorism could result in an amplification of the physicalattack's effects. An example of this mightbe a conventional bombing attack on a building combined with a temporary denial of electrical ortelephone service. The resulting degradation of emergency response, until back-up electrical orcommunication systems can be brought into place and used, could increase the number of casualtiesand public panic. Others believe that the consequences of a cyber-attack on critical infrastructure would be very limited, and that excessive focus has been given to an unsubstantiated terrorist threat. (49) Cyber-security experts who doubt the effectiveness of such an attack rangein opinion regarding an attack'simpact. Some believe that a cyber-attack on critical infrastructure control systems, while havingsome effect, would not be devastating, but rather only have minor impact. (50) For example, securitymanagers in some electric utilities reportedly believe that experience in dealing with natural disastersand power outages may translate well to recovering quickly from a cyber-attack. (51) Other believe thatthere could be significant impacts from a successful attack on control systems, but that such successwould be very unlikely. (52) Finally, some believethat while it is possible to use computers to generatehigh consequence attacks, it would be much more likely that a terrorist group would resort to asimpler conventional attack which would yield results of a similar magnitude. (53) The creation of the Department of Homeland Security has centralized within the Directorate of Information Analysis and Infrastructure Protection a number of offices related to criticalinfrastructure control system security: the Critical Infrastructure Assurance Office (CIAO), theNational Infrastructure Protection Center, the National Infrastructure Simulation and Analysis Center(NISAC), and part of the Department of Energy's Office of Energy Assurance. (54) CIAO and NIPC were created in response to Presidential Decision Directive No. 63, issued in 1998. (55) CIAO coordinated the federalgovernment's initiatives on critical infrastructure assuranceand promotes national outreach and awareness campaigns about critical infrastructure protection. NIPC was a national critical infrastructure threat assessment, warning, vulnerability, and lawenforcement investigation and response agency. Among other programs, NIPC developed theInfraGard program, which serves as a clearinghouse for information sharing and analysis formembers of critical infrastructure industries. NISAC was created in 2001 through the passage of the USA PATRIOT Act. It is charged to "serve as a source of national competence to address critical infrastructure protection and continuitythrough support for activities related to counterterrorism, threat assessment, and risk mitigation." (56) This center is to provide modeling and simulation capabilities for the analysis of criticalinfrastructures, including electricity, oil, and gas sectors. (57) It is located at Sandia NationalLaboratories and Los Alamos National Laboratory. (58) The Department of Homeland Security created a National Cyber Security Division, located in the Information Analysis and Infrastructure Protection Directorate, to identify, analyze, and reducecyber-threats and vulnerabilities; disseminate threat warning information; coordinate incidentresponse; and provide technical assistance in continuity of operations and recovery planning. (59) Thisdivision has the responsibility for implementing programs for research and development in cyber-security, usingexpertise from the Science and Technology Directorate to provide research anddevelopment functions and execution. The President's Critical Infrastructure Protection Board has released The National Strategy to Secure Cyberspace , in which a general strategic overview, specific recommendations and policies,and the rationale for these actions are presented. (60) This document addresses concerns regardingdigital control systems and SCADA networks, rates SCADA network security as a national priority,and recommends joint public/private efforts in discovering solutions to potential vulnerabilities. This strategy identifies the Department of Homeland Security, in coordination with other federalagencies, as the department responsible for developing best practices and new technologies toincrease SCADA security. Some cyber-security experts have criticized this plan, claiming thatvulnerabilities will remain because of its lack of enforcement regulations. (61) The Department of Energy's Office of Energy Assurance has also been involved in developing techniques to secure energy production and availability. (62) Part of this effort has been thedevelopment of "simple, common-sense approaches to improve the overall level of protection inSCADA and digital control networks." (63) Adocument describing a general approach to improvingcyber-security in SCADA systems has been released. (64) Department of Energy National Laboratories. The Department of Energy National Laboratories have developed a series of test bed facilities to testsecurity measures developed for critical infrastructure. The Idaho National Engineering andEnvironmental Laboratory, in conjunction with Sandia National Laboratory, are developing aSCADA test bed to help identify vulnerabilities and improve the security and stability of SCADAsystems. (65) This test bed is part of an integratedCritical Infrastructure Test Range, which includescyber security, wireless communications, power transmission, and physical security testbeds. (66) ThePacific Northwest National Laboratory has developed a Critical Infrastructure Protection AnalysisLaboratory where, among other things, the vulnerability of SCADA systems can be determined. (67) Research into advanced technologies is currently underway at Department of Energy laboratories to address process control system security. For example, Sandia National Laboratoryunder the Laboratory Directed Research and Development program has been developing securecontrol systems for the energy industry. (68) Research includes new information architectures,cryptographic methods, and information system security assessments. Much of this work arises fromneeds discovered through partnerships with systems manufacturers. While a prototype system todemonstrate proof of principle has been implemented at the Sandia National Solar Thermal TestFacility, this system has not been widely implemented in the field. (69) Similar security efforts, thoughless directly focused on industrial control systems, are being developed at both Lawrence LivermoreNational Laboratory and Los Alamos National Laboratory. The National Institute of Standards and Technology (NIST) has initiatives in industrial control system security. NIST, in conjunction with a number of industry groups, federal governmentagencies, and professional societies, have created the Process Control Security Requirements Forumto develop process control information security requirements. Through their Critical InfrastructureProtection program, the National Institute of Standards and Technology is developing informationsecurity requirements, best-practice guidelines, and test methods for the process control sector. (70) Scientists at NIST are also actively involved in many industry-standards forums. The Department of Defense, through the Combating Terrorism Technology Support program, provides support for the protection of infrastructure elements. As part of this program, encryptionalgorithms for SCADA systems are being developed and tested with the end goal of providingrecommendations to industry regarding their use. (71) The Federal Energy Regulatory Commission (FERC) is an independent regulatory agency within the Department of Energy that, among other duties, regulates interstate commerce in oil,natural gas, and electricity. FERC has published a final rule related to critical energy infrastructureinformation. In this rule, critical energy infrastructure information (CEII) is defined as: ... information about proposed or existing critical infrastructure that: (i) Relates to the production, generation, transportation, transmission, ordistribution of energy; (ii) Could be useful to a person in planning an attack on critical infrastructure;(iii) Is exempt from mandatory disclosure under the Freedom of Information Act, 5 U.S.C. 552; and(iv) Does not simply give the location of the criticalinfrastructure. (72) Whether or not information falls under the CEII categorization is initially determined by the companies submitting the information to FERC. Categorization of select information as CEII maylead to greater information sharing between industry and the federal government. The FERC has also published a notice of public rulemaking which includes cyber-security standards for the electric industry. (73) Thisproposed regulation would require the electric industry toself-certify that they are meeting minimum cyber-security standards. It has been reported that FERCwill likely adopt standards developed by the North American Electric Reliability Council in the finalversion of this regulation. (74) The final version ofthis regulation has not been issued. (75) Some industry groups have taken steps towards addressing control system security, generally as part of an overall cyber-security initiative. (76) Some groups have launched initiatives in developinginfrastructure security programs. (77) The NorthAmerican Electric Reliability Council has developeda set of minimum cyber-security standards for the electricity industry, as well as guidelines forsecuring remote access to critical electric infrastructure. (78) Another approach is to develop voluntary best-practices for process control system security. Several organizations are taking part in such initiatives. For example, the Instrument Society ofAmerica has formed a committee, ISA-SP99, to develop a series of reports on best-practices andprocedural improvements which would enhance control system security. (79) Similar efforts areunderway in other technical societies, including the Institute of Electrical and Electronics Engineersand the International Electrotechnical Commission, where working groups on process controlsystems and their security are established. Some industry groups have focused on developing near-term solutions to the legacy equipment security vulnerabilities. For example, the Gas Technology Institute has focused on developingcryptographic protection of SCADA communications and developing a mechanism for retrofittinglegacy equipment to handle these encrypted signals. (80) Other groups have increased outreach effortsto improve understanding of security issues relating to cybersecurity and process control systems. (81) The vulnerability of industrial control systems may be reduced through a range of federalactions. These include the development of standards, either voluntary or mandatory, forcybersecurity of control systems; identifying and addressing critical infrastructure interdependencies;developing encryption methods for control systems; identifying and establishing technologies toaddress existing vulnerabilities; funding long-term research into secure SCADA systems; providingfor free exchange of risk information between the federal government, private industry, and othercritical infrastructure sectors; and assessing federal activities in this area. The federal government could mandate and enforce a uniform security standard for cybersecurity of industrial control systems, or support the development of industry developed andbased standards. Because of the national importance of critical infrastructure systems, a uniformstandard might be developed, with the input of advocates, industries and the federal government,which would include the functionality necessary to protect industrial control systems, whileproviding for more secure operation. A voluntary, standards-based approach has been developed forserver operating systems with some success, and a similar mechanism might be used to developstandards for commercial off-the-shelf control systems. (82) Alternately, processes and specificationscurrently being developed through industry-led programs might be generalized across criticalinfrastructure industries and established as a voluntary standard. Critics of this approach cite themany different uses of industrial control systems in different industry sectors as making such astandard unwieldy. Some experts have expressed concerns that a mandated standard would be lesseffective than a voluntary standard, as solutions to new problems could not be implementedimmediately, but would wait for changes to the standard, and that such a standard may not beuniformly applicable across industry sectors. Others have stated that there is a need for federalrequirements to assure that appropriate attention is focused on process control system security. Identifying the dependencies between critical infrastructure sectors, the vulnerabilities that are present in information technologies in these sectors, and the possible cross-sectoral impacts of acontrol system attack may lead to a greater understanding of the scale of the control system threat. As shown by the August 2003 blackout, the loss of a single infrastructure sector, here the energysector, may have serious effects in other critical infrastructures, such as public health andtransportation. Both the Department of Homeland Security, in its role of protecting infrastructure,and the Department of Energy, in its role of ensuring a robust and reliable energy infrastructure,perform activities in determining sectoral dependencies and commonalities. Policymakers may wishto enhance current funding into SCADA security research, test bed modeling, or criticalinfrastructure vulnerability assessment to further clarify the current vulnerability. Another option would involve supporting encryption research to protect industrial control system data transfer. Encrypting the information transmitted between remote units and theircontrollers would inhibit inclusion of false information to and from industrial control systems. Current encryption technology may not be compatible due to the time required to process theencrypted data and the level of technology built into control system components. Industrial controlsystems have stringent timing requirements and tend to be built out of less computationally robustcomponents, which complicate the use of current encryption technologies. (83) While a prototypeencryption method for industrial control systems has been developed, it is still in the validationprocess (84) and is only recently being evaluated forimplementation in industry. (85) Further researchintoencryption techniques for these processes could provide efficient, market-driven technology forsecuring industrial control systems information. Some experts highlight that securing data transferdoes not assure the security of the control system itself. They assert that other routes of attack existthat do not rely on the security of the control system communications. Thus, securing thosecommunications, while lowering system vulnerability, may not be addressing the most likely threat. Further research and development into methods for retrofitting existing SCADA systems with more secure components or communications may be another method to reduce system vulnerability. This approach has been taken by researchers in both industry and federal government laboratories. While potentially addressing short term needs to reduce vulnerability, retrofit solutions are not likelyto solve inherent shortfalls in SCADA security especially with respect to the inclusion of COTSequipment potentially vulnerable to cyber attack. Critics of retrofit solutions cite high costs andpotential compatibility concerns as barriers to easy implementation of such solutions. A long term approach to limiting the vulnerability of SCADA systems is to provide further targeted investment into developing "next-generation" secure control systems. Development of asecure SCADA architecture may provide incentives to replace components in a secure manner duringthe normal replacement cycle, incrementally reducing the present vulnerability. While some arguesuch product research and development is a responsibility of private industry, others may assert thatcontrol system security is of national import, requiring enhanced federal investment. Several National Laboratories have developed complementary testbed facilities to investigate potential vulnerabilities and solutions to SCADA systems. Such testbed facilities could be used toevaluate and validate the security of commercial SCADA systems, act as a proving ground for newtechnologies, or be dedicated to the development of federal efforts in secure process control systems. The new FOIA exemptions created in the Homeland Security Act of 2002 ( P.L. 107-296 ) may provide a higher volume, freer exchange of information between the federal government andindustry, as industry may become more forthcoming about potential vulnerabilities. The CriticalEnergy Infrastructure Information category for electrical infrastructure information may provide amodel for how regulatory agencies might craft regulations protecting critical infrastructureinformation within a sector. Comments from various groups on the proposed implementation of theHomeland Security FOIA exemption have indicated that industry concern still remains over thepotential release of information given to the federal government by private industry. (86) Policymakersmay wish to inquire into whether vulnerabilities transmitted to the federal government are eventuallyreduced, and how the information being provided to the federal government is used. Policymakers may also wish to assess the effectiveness of the Department of Homeland Security in coordinating security enhancements to control systems, promoting government/industrypartnerships, and performing risk and vulnerability assessments. With the concentration ofpreviously existing agencies into the Directorate of Information Analysis and InfrastructureProtection, previous duplication of effort may be removed, but critics have suggested that difficultiesin integrating these agencies may lead to a reduction in effectiveness. Some policymakers haveexpressed concern that the priorities DHS have placed on physical and cyber-security are notappropriate for the risks involved. (87) Oversightof DHS's efforts to rectify this potential homelandsecurity vulnerability may provide insight into successful models used within critical infrastructuresectors which might be used across multiple sectors.

Summary:
Much of the U.S. critical infrastructure is potentially vulnerable to cyber-attack. Industrial control computer systems involved in this infrastructure are specific points of vulnerability, as cyber-security forthese systems has not been previously perceived as a high priority. Industry sectorspotentially affected by a cyber-attack on process control systems include the electrical, telephone,water, chemical, and energy sectors. The federal government has issued warnings regarding increases in terrorist interest in the cyber-security of industrial control systems, citing international terrorist organization interest incritical infrastructure and increases in cyber-attacks on critical infrastructure computer systems. Thepotential consequences of a successful cyber-attack on critical infrastructure industrial controlsystems range from a temporary loss of service to catastrophic infrastructure failure affectingmultiple states for an extended duration. The National Strategy for Securing Cyberspace , released in February 2003, contains a number of suggestions regarding security measures for control systems. A focus on the further integrationof public/private partnerships and information sharing is described, along with suggestions thatstandards for securing control systems be developed and implemented. The Homeland Security Act of 2002 ( P.L. 107-296 ) transferred and integrated several federal entities that play a role in cyber-security of control systems into the Department of HomelandSecurity. These entities include the Critical Infrastructure Assurance Office, the NationalInfrastructure Protection Center, the National Infrastructure Simulation and Analysis Center, andparts of the Department of Energy's Office of Energy Assurance. Additionally, the HomelandSecurity Act of 2002 created a new class of information, critical infrastructure information, whichcan be withheld from the public by the federal government. Efforts in increasing the cyber-security of control systems occur both at federal government facilities and, in critical infrastructure sectors, through industry groups. The Department of EnergyNational Laboratories, the Department of Defense, and the National Institute of Standards andTechnology all have programs to assess and ameliorate the cyber-vulnerabilities of control systems. Industry-based research into standards, best practices, and control system encryption is ongoing inthe natural gas and electricity sector. Possible policy options for congressional consideration include further development of uniform standards for infrastructure cyber-protection; growth in research into security methods for industrialcontrol systems; assessing the effectiveness of the new exemptions to the Freedom of InformationAct; and the integration of previous offices in the new Department of Homeland Security. This report will be updated as events warrant.