WASHINGTON: A top Biden administration official says the government is undertaking a new effort to help electric utilities, water districts and other critical industries protect against potentially damaging cyberattacks.
Our aim is to ensure that control systems serving 50,000 or more Americans have the core technology to detect and block malicious cyber activity,” Anne Neuberger, deputy national security adviser, said in an interview with The Associated Press on Thursday. “Thats it in a sentence. Clear, clean goal, but its going to take a lot of work to get there.
The public-private partnership reflects the administration’s concerns about the vulnerability of vital systems, including the electric grid and water treatment plants, to hacks that could cause catastrophic consequences to American life. Though there is a history of government working with utilities, officials believe the threat has increased as more utilities are connected to the Internet, and the Biden administration wants to make fast progress in protecting systems that control the utilities.
The administration, meanwhile, has grappled in its first 60 days with responses to two major cyber intrusions. In the first, Russian hackers snuck malicious code into a software update pushed out to thousands of government agencies and private companies. The second even more widespread hack affected Microsoft Exchanges email program.
Microsoft created a one-click tool to fix the issue after the White House encouraged the company to find a simple method for cleaning up from the hack. As a result, the number of compromised systems fell from 100,000 to less than 10,000 and it keeps dropping,” Neuberger said.
She said one idea that was contemplated was whether Microsoft could push a patch to all compromised systems to effectively vaccinate them. Though it was determined that wouldn’t work in this case, the government will continue to work with the private sector to explore that idea for possible future patches.
Neuberger is also the administrations point person in responding to the so-called SolarWinds hack, in which suspected Russian hackers breached at least nine different federal agencies. The AP reported this week that the hackers gained access to email accounts belonging to the Trump administrations head of the Department of Homeland Security and members of the departments cybersecurity staff whose jobs included hunting threats from foreign countries.
Neuberger said there were gaps in basic cybersecurity defenses at some of the nine agencies affected, which has hampered officials ability to determine what the hackers accessed.
She said the administration has identified five specific modernization efforts as a result of its review of how the SolarWinds hack happened, including using technology that continuously monitors for malicious activity and requiring greater use of multi-factor authentication so systems can’t be accessed with a stolen password alone.
That threat to critical infrastructure was laid bare in February after a hackers botched attempt to poison the water supply of a small Florida city raised alarms about how vulnerable the nations utilities may be to attacks by more sophisticated intruders.
A local sheriff said that the water supply of Oldsmar, population 15,000, was briefly in danger when an unknown hacker used a remote access program shared by plant workers to briefly increased the amount of lye sodium hydroxide by a factor of 100. Lye is used to lower acidity, but in high concentrations it is highly caustic and can burn. Its found in drain cleaning products.
A supervisor monitoring a plant console about 1:30 p.m. saw a cursor move across the screen and change settings and was able to immediately reverse it. The intruder was in and out in five minutes. Suspicious incidents are rarely reported and usually are chalked up to mechanical or procedural errors, experts say. No federal reporting requirement exists, and state and local rules vary widely.
The nations 151,000 public water systems lack the financial fortification of the corporate owners of nuclear power plants and electrical utilities. They are a heterogenous patchwork, less uniform in technology and security measures than in other rich countries.
On Wednesday, federal prosecutors charged a Kansas man who they said accessed a rural water districts protected computer system without authorization and performed activities that shut down the processes at the facility which affect the facilities cleaning and disinfecting procedures.
Disclaimer: This post has been auto-published from an agency feed without any modifications to the text and has not been reviewed by an editor
Read all the Latest News, Breaking News and Coronavirus News here. Follow us on Facebook, Twitter and Telegram.
Comments
0 comment