Weaknesses in Industrial Cyber Security Described
The vulnerabilities of critical energy infrastructure installations to potential cyber attack are normally treated as restricted information and are exempt from public disclosure. But a recent Department of Energy report was able to openly catalog and describe the typical vulnerabilities of energy infrastructure facilities because it did not reveal the particular locations where they were discovered.
“Although information found in individual… vulnerability assessment reports is protected from disclosure, the security of the nation’s energy infrastructure as a whole can be improved by sharing information on common security problems,” the DOE report (pdf) said. “For this reason, vulnerability information was collected, analyzed, and organized to allow the most prevalent issues to be identified and mitigated by those responsible for individual systems without disclosing the identity of the associated… product.”
The specific vulnerabilities that were found are no big surprise — open ports, unsecure coding practices, and poor patch management. But by describing the issues in some detail, the new report may help to demystify the cyber security problem and to provide a common vocabulary for publicly addressing it. See “NSTB Assessments Summary Report: Common Industrial Control System Cyber Security Weaknesses,” Idaho National Laboratory, May 2010.
Denice Ross, former U.S. Chief Data Scientist and Data Policy Institute lead at the Federation of American Scientists, will be honored for her stewardship of public data by the National Academy of Public Administration, where she has been named a Fellow.
Confirmation that the construction of the security perimeter and associated security infrastructure at RAF Lakenheath are still ongoing once again raises questions about whether U.S. nuclear weapons have already been deployed to the base.
Alaskans are sensibly pulling back from the vogue for bans and returning to a western tradition that has worked for more than half a century – one that welcomes innovation but also oversees it closely.
The strength of our nation’s data policy isn’t just in the rules we write, but in how effectively we translate those rules into a system that prioritizes the public good. Join us in this movement to design and build more resilient national data policies.