Critical infrastructures are physical or virtual systems and assets so vital to the nation that their incapacitation or destruction would have a debilitating impact on national and economic security, public health, and safety. These systems and assets—such as the electric power grid, chemical plants, and water treatment facilities—are essential to the operations of the economy and the government. Recent terrorist attacks and threats have underscored the need to protect our nation’s critical infrastructures. If vulnerabilities in these infrastructures are exploited, our nation’s critical infrastructures could be disrupted or disabled, possibly causing loss of life, physical damage, and economic losses. Although the vast majority of our nation’s critical infrastructures are owned by the private sector, the federal government owns and operates key facilities that use control systems, including oil, gas, water, energy, and nuclear facilities (see fig. 1). Control systems are computer-based systems that are used within many infrastructures and industries to monitor and control sensitive processes and physical functions. Typically, control systems collect sensor measurements and operational data from the field, process and display this information, and relay control commands to local or remote equipment. Control systems perform functions that range from simple to complex. They can be used to simply monitor processes—for example, the environmental conditions in a small office building—or to manage the complex activities of a municipal water system or a nuclear power plant. In the electric power industry, control systems can be used to manage and control the generation, transmission, and distribution of electric power (see fig. 2). For example, control systems can open and close circuit breakers and set thresholds for preventive shutdowns. The oil and gas industry uses integrated control systems to manage refining operations at plant sites, remotely monitor the pressure and flow of gas pipelines, and control the flow and pathways of gas transmission. Water utilities can remotely monitor well levels and control the wells’ pumps; monitor flows, tank levels, or pressure in storage tanks; monitor water quality characteristics such as pH, turbidity, and chlorine residual; and control the addition of chemicals to the water. Control systems are also used in manufacturing and chemical processing. Chemical reactors may use control systems to produce chemicals or regulate temperatures within the production process. Installing and maintaining control systems requires a substantial financial investment. DOE cites research estimating the value of the control systems used to monitor and control the electric grid and the oil and natural gas infrastructure at $3 billion to $4 billion. The thousands of remote field devices represent an additional investment of $1.5 billion to $2.5 billion. Each year, the energy sector alone spends over $200 million for control systems, networks, equipment, and related components and at least that amount in personnel costs. There are two primary types of control systems: distributed control systems and supervisory control and data acquisition (SCADA) systems. Distributed control systems typically are used within a single processing or generating plant or over a small geographic area, while SCADA systems typically are used for large, geographically dispersed operations. For example, a utility company may use a distributed control system to manage power generation and a SCADA system to manage its distribution. A SCADA system is generally composed of six components: instruments, operating equipment, local processors, short-range communication, host computers, and long-range communications. Instruments sense conditions such as pH, temperature, pressure, power level, and flow rate. Operating equipment includes pumps, valves, conveyors, and substation breakers that can be controlled by energizing actuators or relays. Local processors communicate with the site’s instruments and operating equipment. Local processors go by several different names, including programmable logic controller, remote terminal unit, intelligent electronic device, and process automation controller. A single local processor may be responsible for dozens of inputs from instruments and outputs to operating equipment. Local processors can collect instrument data; turn on and off operating equipment; translate protocols so different controllers, instruments, and equipment can communicate; and identify alarm conditions. Short-range communication consists of the relatively short cables or wireless connections that carry analog and discrete signals between the local processors and the instruments and operating equipment. The communication uses electrical characteristics such as voltage and current or other established industrial communications protocols. Host computers are the central point of monitoring and control. The host computer is where a human operator can supervise the process, receive alarms, review data, and exercise control. In some cases the host computer has logic programmed into it to provide control over the local processors. The host computer may be called the master terminal unit, the SCADA server, or a personal computer. Long-range communication consists of the communication between the local processors and host computers. This communication typically covers miles using methods such as leased phone lines, satellite, microwave, and cellular packet data. Figure 3 illustrates the major components of a SCADA system and Figure 4 illustrates how these components would be distributed in a typical water utility. These components can be adapted to perform specific functions in many industrial sectors. For example, the following graphic shows the application of these components in a water treatment and distribution system. Federal law and policies call for critical infrastructure protection activities to enhance the cyber and physical security of both public and private infrastructures that are essential to national security, national economic security, and national public health and safety. Federal policy designates certain federal agencies as lead points of contact for each key critical infrastructure sector (see table 1). Further, it assigns agencies responsibility for infrastructure protection activities in their assigned sectors and for coordination with other relevant federal agencies, state and local governments, and the private sector. In addition, federal policy establishes DHS as the focal point for the security of cyberspace— including analysis, warning, information sharing, vulnerability reduction, mitigation, and recovery efforts for public and private critical infrastructure information systems. To accomplish this mission, DHS is to work with other federal agencies, state and local governments, and the private sector. Several key federal plans focus on securing critical infrastructure control systems. The cyberspace strategy calls for DHS and DOE to work in partnership with industry to develop best practices and new technology to increase the security of critical infrastructure control systems, to determine the most critical control systems-related sites, and to develop a prioritized plan for short-term cybersecurity improvements for those sites. In addition, DHS’s National Infrastructure Protection Plan specifically identifies control systems as part of the cyber infrastructure, establishes an objective of reducing vulnerabilities and minimizing severity of attacks on these systems, and identifies programs directed at protecting control systems. Further, in May 2007, the critical infrastructure sectors issued sector-specific plans to supplement the National Infrastructure Protection Plan. Twelve sectors, including the chemical, energy, water, information technology, postal, emergency services, and telecommunications sectors, identified control systems within their respective sectors. Of these, most identified control systems as critical to their sector and listed efforts under way to help secure them. Critical infrastructure control systems face increasing risks due to cyber threats, system vulnerabilities, and the potentially serious impact of an attack as demonstrated by reported incidents. Cyber threats can be unintentional or intentional, targeted or nontargeted, and can come from a foreign, domestic, or inside source. Control systems can have vulnerabilities that make them susceptible to cyber attacks, including the increased connectivity of control systems to other systems and the Internet. Further, based on past events, the impact of a control systems incident on a critical infrastructure could be substantial. Cyber threats can be unintentional and intentional, targeted or nontargeted, and can come from a variety of sources. Unintentional threats can be caused by software upgrades or maintenance procedures that inadvertently disrupt systems. Intentional threats include both targeted and nontargeted attacks. A targeted attack is when a group or individual specifically attacks a critical infrastructure system. A nontargeted attack occurs when the intended target of the attack is uncertain, such as when a virus, worm, or malware is released on the Internet with no specific target. There is increasing concern among both government officials and industry experts regarding the potential for a cyber attack on a national critical infrastructure, including the infrastructure’s control systems. The Federal Bureau of Investigation has identified multiple sources of threats to our nation’s critical infrastructures, including foreign nation states engaged in information warfare, domestic criminals and hackers, and disgruntled employees working within an organization. Table 2 summarizes those groups or individuals that are considered to be key sources of threats to our nation’s infrastructures. Control systems are vulnerable to flaws or weaknesses in system security procedures, design, implementation, and internal controls. When these weaknesses are accidentally triggered or intentionally exploited, they could result in a security breach. Vulnerabilities could occur in control systems’ policies, platform (including hardware, operating systems, and control system applications), or networks. Federal and industry experts believe that critical infrastructure control systems are more vulnerable today than in the past. Reasons include the increased standardization of technologies, the increased connectivity of control systems to other computer networks and the Internet, insecure connections, and the widespread availability of technical information about control systems. Further, it is not uncommon for control systems to be configured with remote access through either a dial-up modem or over the Internet to allow remote maintenance or around-the-clock monitoring. If control systems are not properly secured, individuals and organizations may eavesdrop on or interfere with these operations from remote locations. Reported attacks and unintentional incidents involving critical infrastructure control systems demonstrate that a serious attack could be devastating. Although there is not a comprehensive source for incident reporting, the following attacks, reported in government and media sources, demonstrate the potential impact of an attack. Worcester air traffic communications. In March 1997, a teenager in Worcester, Massachusetts, disabled part of the telephone network using a dial-up modem connected to the system. This disabled phone service to the airport control tower, airport security, the airport fire department, the weather service, and the carriers that use the airport.