McAfee vice president, Ross Allen, said the appearance of threats like Stuxnet should act as a wake-up call to all businesses related to critical infrastructure.
"We've seen attacks on critical infrastructure already with things like Stuxnet, malware designed to bring down the centrifuges of a power plant with a viral malware inside of a process control environment," said Allen, speaking during a debate at the Trustmarque summit in London (pictured above).
"By taking down a utility grid, or a pipeline, or an ATM network you block access to funds, to water, to electricity. It's the Blitzkrieg of 1939 in 2013.
"Because of this, at McAfee we're very focused not just on how we work with government, but also how we work with the private sector. This is because the attacks aren't just going to be on governments, it's going to be on the infrastructure that lays down and facilitates the movement of information within the country."
Allen said that even with the risk, firms must avoid taking overly rash measures when developing new strategies to counteract the threats.
"It's important we do this without scaring too many folks. Our industry is already too governed by scare tactics and I'd rather have it that we just helped people with preparedness. I'd like it to be like Y2K - we got through that just by being prepared and no lights went out. Preparedness and readiness can remove fear," he said.
However, Symantec chief technology officer Darren Thomson said many firms have already taken a misguided approach when reacting to such threats, looking for simple technological answers.
"Given the threats we've been describing, I think I'd agree with the idea that it's about preparedness. We've seen a lot of organisations in both the private and public sector make an attempt to prepare but I see a lot preparation in the technology aspect space of the infrastructure. There's certainly some merit to that, that's one piece of the jigsaw, but at Symantec we think you have to think a little more comprehensively about preparedness," said Thomson.
"We're seeing a lot of people preparing but, in many ways, nine out of 10 of them are preparing for the wrong thing. Preparedness doesn't just mean buying up McAfee, Symantec or whoever else's technology tomorrow, it means becoming prepared, making a plan."
The Symantec chief added that firms must consider how the threats relate to them and their individual assets when combating cyber threats.
"I think it's important organisations in the private or public sector don't get too obsessed with all the bad stuff that's going on in the world and think a little bit more about what it means to them; they need to contextualise it. That's good old-fashioned risk management," said Thomson.
"For a bank, the threats will be very different to those for a Formula One team and those again would be very different to a local government. You need to think what the assets of a company are that have to be protected. Assets for me are becoming less and less about infrastructure and more about data and information. "
The McAfee vice president mirrored Thomson's attitude, saying that threats like Stuxnet are a government issue that many states are already dealing with. "A while ago the electrical grid went down in the southeast US and the belief of the US government was that it was a Trojan that had been executed," said Allen
"Theoretically you could declare that an act of war, which is why president Obama has changed what constitutes the declaration of war. He changed it because the activity with the Chinese – bringing down an electrical grid, redirecting traffic at the Department of Defense – could be viewed that way."
The two security experts' comments come during a wider push by the UK government to improve the nation's cyber defences. The push began in 2011 when the government pledged to invest £650m to help protect businesses operating in the country from cyber threats as a part of its wider cyber strategy.
The strategy has seen the launch of numerous initiatives, including the creation of two new cyber security higher education centres at Oxford and Royal Holloway London university, announced late last week
No comments:
Post a Comment