This report addresses the cyber-vulnerability of critical infrastructure industries which regularlyuse industrial control systems. Industrial control systems may be vulnerable to infiltration bydifferent routes, including wireless transmission, direct access to control system computers,exploitation of dial-up modems used for maintenance, or through the Internet. This report willspecifically discuss the potential for access to industrial control systems through the Internet. The vulnerability of U.S. critical infrastructure to cyber-attack and catastrophic failure was brought to light in 1997 in the report of the President's Commission on Critical InfrastructureProtection. (1) Among other concerns, the computersystems used to remotely control processequipment were highlighted as specific points of vulnerability. These systems were updated duringthe Y2K crisis, but their cyber-security generally has not been a high priority. The events ofSeptember 11, 2001 have heightened the public awareness of the nation's vulnerability to terroristattack, and a National Research Council report has identified "the potential for attack on controlsystems" as requiring "urgent attention." (2) Critical infrastructure is defined in the USA PATRIOT Act as those "systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of suchsystems and assets would have a debilitating impact on security, national economic security, nationalpublic health or safety, or any combination of those matters." (3) Several industry sectors consideredto be critical infrastructures use industrial control systems in their daily activities. These industriescould be significantly affected by a cyber-attack targeting industrial control systems such assupervisory control and data acquisition (SCADA) systems, distributed control systems, and others. The President's Commission on Critical Infrastructure Protection report stated, From the cyber perspective, SCADA systems offer some of the most attractive targets to disgruntled insiders and saboteurs intent on triggering a catastrophicevent. With the exponential growth of information system networks that interconnect the business,administrative, and operational systems, significant disruption would result if an intruder were ableto access a SCADA system and modify the data used for operational decisions, or modify programsthat control critical industry equipment or the data reported to controlcenters. (4) The most commonly discussed industrial control systems include supervisory control and dataacquisition (SCADA) systems and distributed control systems (DCS). (5) SCADA systems are oftenused for remote monitoring over a large geographic area and to transmit commands to remote assets,such as valves and switches. For example, they can be found in water utilities and oil pipelines,where they monitor flow rates and pressures. Based on the data that these systems provide, computerprograms or operators at a central control center balance the flow of material. Generally, SCADAsystems process little data internally, instead performing analysis in a more central location, but arethe primary conduits for raw data to and commands from a control center. They may be vulnerableto implantation of faulty data and to remote access through dial-up modems used for maintenance. Distributed control systems are process control systems, commonly deployed in a single manufacturing or production complex, characterized by a network of computers. DCS generallyprovide processed information to, or a series of commands from, a central location. For example,at a chemical plant, a DCS might simultaneously monitor the temperature of a series of reactors andcontrol the rate at which reactants are mixed together, while performing real time processoptimization and reporting the progress of the reaction. An attack targeting a DCS might causeextensive damage at a single facility, but might not affect more than the single site. These process control systems can be interconnected within a single industry as well. This might be the case in an infrastructure which both transports and processes material. As an example,the oil and gas infrastructures contain both processing and refining sites, as well as holding facilitiesand distribution systems. Refining and processing sites may utilize DCS in discrete locations. Thedistribution and holding facilities might be managed by a SCADA system which collected data fromand issued commands to different geographic sites from a single location. (6) Industrial control system technologies are often employed in critical infrastructure industries to allow a single control center to manage multiple sites. Industrial control systems were originallyimplemented as isolated, separate networks. (7) Theywere viewed as secure systems which protectedremote locations from being physically broken into and mistreated. For example, the establishmentof remote control systems in dams reportedly protected against unlawful release of the dammedwater, as no hand-operable valves and switches were accessible. (8) The networking of industrial control systems on a greater scale has led to increased synergy and efficiency, and, due to market needs (e.g. deregulated markets), real time information from thesesystems is increasingly important for commercial purposes. Consequently, industrial control systemsare becoming linked to corporate computer systems, potentially making them vulnerable to cyber-attack throughthe Internet. Original control systems were designed to be free standing networkswithout Internet access. Therefore, it has been necessary to add network access capabilities to theselegacy systems to integrate them into the corporate structure. This has created, in the worst cases,a labyrinth of connections which is perhaps not rigorously constructed for cyber-security or welldocumented. Many organizations, including the General Accounting Office, researchers at several Department of Energy National Laboratories, and private security and consulting companies, haveidentified systemic and specific security vulnerabilities in select process control systems. (9) Amongthese vulnerabilities are poor cyber-security practices, such as weak passwords, a lack of robustprotocols, and communication in clear text. While some vulnerabilities arise from the manner bywhich the process control system is operated, others are believed to be integral to the control systemconfiguration itself. Some industrial control systems, including legacy systems, are proprietary, and contain non-standard architectures and command syntax. This can be considered both an advantage and adisadvantage. Proprietary systems with esoteric command structures are often non-intuitive, andcould be difficult to operate by an untrained individual. Incorrect commands could cause no results,and may increase the probability that the intruder would be noticed and removed from the system.Additionally, different companies may have different command sets, even if they are both membersof the same industry, as their proprietary systems may have significantly different structures. Thus,if a hacker or terrorist successfully attacks one company, that experience may not be valuable for useat the next company. Others assert that many new control systems, as well as upgrades to legacysystems, are being assembled from commercial, off-the-shelf equipment and software, providingcommonalities across different industry sectors. They point to the needs of system maintenance andnew component integration as leading to similar control system architectures both within andbetween critical infrastructure sectors. By adopting such equipment and software, vulnerabilities thatare identified impact all sectors. The degree of integration between control system networks and publicly accessible networks is difficult to judge from the open literature. This makes assessment of the vulnerability of criticalinfrastructure industries from Internet based attack difficult to know with certainty. (10) Faced with anunclear risk, it may be difficult, from an industry perspective, to justify the additional costs ofupgrading privately-held industrial control systems to higher security standards. (11) Current off-the-shelf industrial control systems have been designed foroperational speed and functionality, ratherthan for secure operation, and therefore may not have a high degree of operational security. (12) Addition of security requirements may degrade the performance of these components belowoperating standards. Events have shown that utility control system networks may be vulnerable to cyber-based incidents. Computers at an inactive nuclear power plant in Ohio were infected by the Slammerworm in January 2003. The infection disabled some computer functionality, including monitoringsystems for portions of the power plant. (13) Also,it has been reported that other control systemcomputers have been compromised by other viruses. (14) Given the uncertain vulnerability level and the potential systemic weaknesses involved in current off-the-shelf technology, there appears to be little market incentive to directly increaseindustrial control systems security. Therefore the security systems for the corporate network, whichblock initial intrusion through the Internet, may be the sole planned protection for the industrialcontrol systems. Such an approach has been criticized, as while it may provide initial barriers tointrusion, it would not reduce any inherent vulnerabilities in the control system network. (15) Security analysts also contend that industrial control systems are less obscure now than when they were initially developed. Foreign utility companies increasingly use current commercial off-the-shelf industrialcontrol systems, increasing the international availability of systems and theirdocumentation. Due to the similarity between these systems and systems installed domestically,potential terrorists need not break into an American utility to test their plans. (16) Instead, preliminarytesting might be performed outside of the United States on equipment held in other countries. Some security analysts believe that the industrial control system vulnerability should be addressed before potentially catastrophic events occur, and that techniques for reducing thevulnerability are already known. They contend that the majority of attacks on industrial controlsystems will come through corporate networks, via the Internet. While standardized informationtechnology protection methods have not yet been developed specifically for industrial controlsystems, these analysts contend that if general network benchmark standards were uniformly appliedacross corporate networks, corporate networks vulnerability to intrusion could be reduced by 80-88%. (17) This would indirectly reduce the industrial controlsystems vulnerability to intrusion, asroutes through the corporate network would no longer be available. These benchmark standardsinclude disabling unneeded server functionality, patching known security flaws, and updatingprograms to the most recent version. Other security analysts claim that in addition to general network security, specific protection for industrial control systems must also be established. Such protection might be addressed bysuccessfully isolating the control system network from the corporate computer network or byimplementing stronger security measures at known junctions of the two networks.