The FSB said Friday that the attacks would be accompanied by a stream of text messages and posts on social networks containing claims of an imminent collapse of Russia’s major banks and the financial system’s breakdown. It said the action would target several dozen Russian cities.

The Obama administration has accused Russia of conducting a series of hacks to interfere with the U.S. election, accusations Moscow has denied.

Last Friday, cyberattacks crippled a major internet firm, repeatedly disrupting the availability of popular websites across the United States. Members of a shadowy hacker group that calls itself New World Hackers claimed responsibility for the attack, but that claim could not be verified.

Homeland Security Secretary Jeh Johnson confirmed Oct. 24 the Mirai botnet was used to perpetrate the large-scale distributed denial-of-service attack, leveraging a worldwide network of connected devices to send junk traffic at one of the companies that manages internet traffic.

DHS is working with the intelligence community — through the National Cybersecurity and Communications Integration Center — and is developing “a set of strategic principles for securing the Internet of Things, which we plan to release in the coming weeks.”

“That will be our future,” he told a crowd of officers, academics and industry experts gathered for a two-day symposiumin central London.

Chichester was seconded by Air Force Lt. Gen. James K. McLaughlin, deputy commander at U.S. Cyber Command, who told attendees that infrastructure-wrecking attacks were being seen “right now in the environment.”

Neither official went into specifics about what they’d seen or why they felt the threat was intensifying, although McLaughlin invoked a cyberattack in Ukraine that knocked out three separate power distribution companies last year. The Dec. 23 incident, believed to have been pulled off by a team of hackers using stolen passwords, left 225,000 people without electricity, according to a U.S. Department of Homeland Security bulletinpublished two months later.

Cybersecurity experts long worried that hackers can hijack the vulnerable industrial control systems to wreak havoc in power plants, traffic systems, factories, dams or reservoirs. Still, publicly confirmed examples of real-world damage from hacking have — so far — been few and far between. The Ukrainian incident provided a rare and dramatic demonstration of the physical consequences of a well-organized cyberattack.

McLaughlin said there was now no doubt such hacks were possible.

“Three years ago these were just theoretical,” he said. “Now we see them. They’re practically here in front of us.”

Fed Chair Janet Yellen has said that cybercrime is a “very significant threat.”

The proposal, open to public comment for three months, would apply to banks with $50 billion or more in assets. That would affect several dozen major banks and a few big insurance companies, all deemed to be so interconnected with the financial system that a cyberattack against one of them could shake the system’s stability.

In a stunning incident early this year, hackers diverted $101 million from the Bangladesh central bank’s account at the New York Federal Reserve.

The theft amplified worries about the security of the SWIFT global money-transfer system, which is overseen by the Fed and other central banks. Belgium-based SWIFT, formally the Society for Worldwide Interbank Financial Telecommunication, is a cooperative that manages the international transfer system among banks. The hackers in the Bangladesh bank case apparently got the money by stealing the central bank’s SWIFT access codes.

The rules proposed by the three agencies would pile on a second set of stricter standards for big banks’ computer systems that are considered critical to the functioning of the financial industry.

The banks should establish goals for how long it would take them to recover from a cyberattack and should assess the potential for malware or corrupted data to spread through connected computer systems, the regulators said.

The proposal doesn’t require the banks to submit their cybersecurity plans for approval or to notify the regulators if they suffer a data breach.

Beyond their oversight of banks’ efforts, the agencies themselves have suffered some serious security breaches. Computers at the Fed were penetrated dozens of times between 2011 and 2015, according to House lawmakers. The breaches raised concerns about the Fed’s ability to safeguard sensitive financial information in its computer systems, the lawmakers said.

The Chinese government, meanwhile, is believed to have hacked into computers at the FDIC in 2010, 2011 and 2013, including the workstation of then-FDIC Chair Sheila Bair, according to a congressional report. It cites a May 2013 memo from the FDIC inspector general to agency Chairman Martin Gruenberg, describing an “advanced persistent threat” said to have come from the Chinese government — which compromised 12 computer workstations and 10 servers at the FDIC.

The issue of suspected Chinese government hacking has been sensitive since the disclosure last year of a massive breach of the U.S. Office of Personnel Management’s databases, which the U.S. believed was carried out by Chinese cyber spies. In one of the worst data breaches in U.S. history, the personal files of 21 million Americans were stolen.

And perhaps the most concerning of news activity was the announcement by head of the United Nations nuclear watchdog, International Atomic Energy Agency Director Yukiya Amano, that a nuclear power plant in Germany was hit by a “disruptive” cyberattack within the past three years. Amano was quoted by Reuters as saying: “This issue of cyberattacks on nuclear-related facilities or activities should be taken very seriously. We never know if we know everything or if it’s the tip of the iceberg.” And he noted that this is ” not an imaginary risk.”

It should also be noted that in 2014, a computer in the control room at Monju Nuclear Power Plant in Tsuruga, Japan, was subjected to malware, but possibly by accident. And in 2015, South Korean hackers targeted Korea Hydro and Nuclear Power Company, but luckily to no avail. Most cyber experts believe that North Korea was behind the attempted cyberattack. These incursions are a wake-up call as there is a very real and growing fear that a future cyberattack on a nuclear plant could risk a core meltdown.

Non-nuclear power plants have also been subjected to intrusions and breaches. A hack in Ukraine was held up as a prime example. In December 2015, hackers breached the IT systems of the electricity distribution company Kyivoblenergo in Ukraine, causing a three-hour power outage.

Refineries, dams and data centers are all potential targets of cyber incursion. According to a report released last month titled “The Road to Resilience: Managing and Financing Cyber Risks,” oil and gas companies around the world could face costs of up to $1.87 billion in cybersecurity spending by 2018.

There have been attempted cyberattacks on grids and utilities, many via phishing and ransomware, and some have been successful. Adm. Mike Rodgers, head of the National Security Agency and U.S. Cyber Command, has stated that only two or three countries have the ability to launch a cyberattack that could shut down the entire U.S. power grid and other critical infrastructure.

Much of our grid still relies on antiquated technologies, and more investment in defenses are needed. As technology exponentially advances and as threat actors (including cyber mercenaries) gain tools via the dark web, that number of potential state-sponsored adversaries could expand in the near future.

In 2013, President Barack Obama issued Executive Order 13636, “Improving Critical Infrastructure Cyber-security,” which called for the establishment of a voluntary risk-based cybersecurity framework between the private and public sectors.

Rep. 

Trent Franks

, R-Ariz., chairman of the congressional EMP Caucus, and considered the foremost expert in Congress on electromagnetic pulses,

has introduced legislation ( HR 3410) called the Critical Infrastructure Protection Act. The law would enable DHS to implement practical steps to protect the electric grid by training and mobilizing first responders for possible EMP events.

Along with Franks and Peter Prye, who heads the Task Force on National and Homeland Security (a congressional advisory board), several noted industry and policy experts, including former CIA Director Jim Woolsey; Frank Gaffney, former deputy secretary of defense and president and CEO of the Center for Security Policy; and Michael Del Rosso, former chairman of IEEE-USA Critical Infrastructure Protection Committee have been especially active in alerting the public to the critical need to find near-term solutions to protect the grid.

Clearly the entire energy critical infrastructure is justified in garnering the attention of DHS, states, regulatory organizations and the many subject-matter experts on the topic of cybersecurity.

While the threats are complex and the threat actors varied among hackers, state sponsors, organized criminal enterprises and terrorists, there are several themes to adhere to mitigate risk. These include:

• Remain vigilant and continually analyze and game the energy cyberthreat landscape, as the methods, means and malware variants are constantly morphing.
• Share and communicate cybersecurity information between the public and private sectors (a majority of the energy infrastructure is owned by the private sector). The government and industry are currently using pilot programs including Cybersecurity Risk Information Sharing Program and the Trusted Automated eXchange of Indicator Information to facilitate rapid sharing of security information. DHS NPPD has established an active and successful program in the area. DHS’ Cybersecurity Emergency Response Team responded to 295 cyber incidents in the energy sector in 2015.
• Follow industry protocols, especially related to Supervisory Control and Data Acquisition (SCADA). Power companies use SCADA networks to control their industrial systems, and many of these networks need to be updated and hardened to meet growing cybersecurity threats.
• Maintain robust access management control and cyber incident response programs. This includes following National Institute of Standards and Technology, North American Electric Reliability Corporation, Federal Energy Regulatory Commission and U.S. Nuclear Energy Regulatory Commission cybersecurity protocols.
• Invest in next-generation security controls and cybersecurity technologies.

The World Energy Council says countries must raise their game in combating cyberattacks on nuclear and other energy infrastructures. They note that the frequency, sophistication and costs of data breaches are increasing. The expanding cybersecurity focus on energy infrastructure by both the public and private sectors is certainly a welcome development.

Charles “Chuck” Brooks serves as the vice president for government relations and marketing for Sutherland Government Solutions. He served at the Department of Homeland Security as the first director of legislative affairs for the Science and Technology Directorate. Find him on Twitter at @ChuckDBrooks. 

Though he had not previously discussed these events publicly, Amano did say he highlighted the issue of increasing precautionary measures for nuclear sites at an IAEA cybersecurity conference in June 2015 and increasing cyber and overall nuclear security would be a topic again at a summit in Vienna in December.

While no hackers have impacted reactor operations at nuclear installations, there have been cases of data exfiltration and viruses infecting internal networks.

Amano said IAEA continues to support global nuclear security training databases and the distribution of thousands of compact radiation detection devices.

On the side of cyber defense, one emerging dynamic that must worry intelligence agencies is the international, crowd-sourced nature of technical analysis. Because data packets do not wear uniforms, computer network operations are more like covert action than traditional military operations — they are supposed to remain secret.

However, from the Cuckoo’s Eggto Stuxnet to the DNC hack, all cyberattacks share this mysterious quality: If they rise above a certain threshold of pain, curious scientists in disparate and previously disconnected laboratories will sacrifice a certain amount of sleep in order to find even one piece in a very large puzzle. And, as seen in “Zero Days,” even a three-letter agency like the NSA (National Security Agency) appears to want to offer some juicy details, including the assertion that it was Israel, and not Fort Meade, who blew the operation.

The national security implications of Stuxnet are as controversial as ever. The technical nature of the topic, the “attribution problem” and over-classification give government hackers the space to do whatever they can get away with. But the laws of war dictate that militaries must operate within certain predefined parameters.

As a technical expert to the Tallinn Manualprocess, I believe that our understanding of a national security threat must evolve with technology. This is happening, but slowly. For example, no one is quite sure where the line is between cyber espionage and cyberattack. Once a hacker is in position to read an adversary’s traffic, he or she can also manipulate it. Hence, the colocation of NSA and Cyber Command; the former has the technical capability to hack networks, while the latter has the authority to manipulate data.

We have already seen hints of self-imposed restrictions: Instead of compromising as many machines as possible, Stuxnet wanted to hack as few as possible. Further, one of the “kill dates” found in the code, Jan. 11, 2009, was just a week before the presidential inauguration of Barack Obama. Apparently, a legal team had decided that a presidential reauthorization of the operation was necessary.

“Zero Days” asks all of us to think harder about national security in the digital age, specifically from the standpoint of arms control and international norms. In the film, an alleged secret government source claims that Stuxnet was only a small part of ” Nitro Zeus,” a larger operation that could theoretically knock Iran right out of cyberspace. The right question to ask, then, is whether Iran (or more likely, Russia or China) could do the same to the U.S., and whether crossing the digital Rubicon with Stuxnet was worth it.

It is widely believed that Iran sent a message to the West in retaliatory cyberattackson Saudi Aramco and Wall Street, thereby signaling that the U.S. does not have a monopoly on cyber weapons.

The U.S. has more strategic depth in cyberspace than all of the world’s dictators combined, but we still have a lot to lose. Our economies and democracies depend on critical infrastructure, which, in turn, depend on the proper functioning of the internet. This is why, for example, the Department of Homeland Security spent significant resources to protect the U.S. from … guess what? Stuxnet.

And relative to international norms, a legitimate fear is that this operation set a bad precedent: The U.S. did it, so it must be OK.

As the Internet of Things expands all around us, the line between “cyberspace” and “physical space” will disappear. In “Zero Days,” researchers demonstrated this in a laboratory by popping a balloon with a Stuxnet-infected computer. At NATO’s annual Locked Shieldscyber defense exercise, we attached small fireworks to miniature factories.

Of course, the public will never understand all the technical aspects of Stuxnet, and there is nothing simple about the idea of cyber arms control. But just like Bush in the Situation Room, the public can see when something is physically destroyed. And by comparison, it should be simple to begin an international discussion on cyberwarfare in order to examine how we might limit the size of the cyber battlefield.

In my view, none of these issues raised in “Zero Days”

is hyperbole, and this film is worth your time.

Kenneth Geers (PhD, CISSP) is a senior research scientist at Comodo

, a global innovator and developer of cybersecurity solutions. He is also a NATO CCD COE (Cyber Centre) ambassador, a non-resident senior fellow at the Atlantic Council, an affiliate at the Digital Society Institute of Berlin, a visiting professor at Taras Shevchenko National University of Kyiv in Ukraine, and an accomplished author.

Threats are increasing daily across every industry worldwide. If actions are not taken to bridge the cybersecurity workforce gap, particularly within government agencies, society will become paralyzed. Solving the known unknowns and the unknown unknowns of tomorrow requires educating, building and reinforcing our cybersecurity talent pool and workforce. This involves training the people using technology that transmits data to understand what information is held within the data, as well as creating more of the professionals working behind the scenes to protect it moving forward.

Ensuring the secure future of our society and global economies depends on security technology innovation, but it also depends on the people who operate our global cyber businesses. While there are many unknowns on the horizon, what we do know is that cybersecurity will continue to remain a hot topic. We need an expanded, skilled cybersecurity workforce today to protect against the unknown threats of tomorrow.

Steve Kirk is a cybersecurity professional with 17 years of experience, 11 of them with Fortinet. Prior to Fortinet, he worked for network security company Secure Computing, 3Com and Foundry. Kirk has 26 years of experience supporting the U.S. federal sector. He is a graduate of Radford University.

More specifically, he hacked the plane’s inflight entertainment system. Details did grow a little murky from there, with an FBI affidavit asserting that Roberts hacked a plane inflight, causing it to veer off course – a claim that plane manufacturer Boeing and aviation adamantly denied as humanly possible.

Special Multimedia Report

Critical Risk: Assessing the cybersecurity of the nation’s infrastructure

But questions of what is or what may be possible are exactly what spur increasing fear among the traveling public – some legitimate, some not – and attention from leadership within the transportation sector, tasked with managing the risk.

All modes of transportation are becoming more reliant on cyber-based functions, and as technology asserts itself, that will become more the case, said Mark Troutman, director at the Center for Infrastructure Protection and Homeland Security at George Mason University. He pointed to a proposal under development for a new system that can link trucks together under the control of one human driver.

“You and I would see four or five trucks tailgating each other, hooked together virtually,” he said. “That’s great, because you can have five tractor trailers that are controlled by one person. If I’m a business owner, it’s perfect; immediate cost control. But think of the ability of an adversary to untether those.”

“That’s just one example,” Troutman added. “There are others,” covering the gamut of planes, trains and automobiles.

But in cybersecurity there is a fine line between rational threat analysis and fear mongering. Cybersecurity experts often say that criminals and enemy nation states have the ability to do cyber damage, but choose not to. For the former, the payoff is too uncertain and for the latter, the potential retaliation too staggering. As Troutman said, “I can spin a scenario of untethering a truck, but that would be complex to pull off and one would need to ask why anybody would bother to properly evaluation the nature of the threat.

That is a struggle for the aviation industry, which has been evolving toward much more interconnected systems by necessity, where data is shared between government and industry, which the Federal Aviation Administration in turn must regulation – from airlines as well as the aircraft manufacturers.

“As we are sharing information across technological systems, we’re opening certainly more gateways into those systems, and we need to be very, very vigilant and thoughtful about who we provide access,” said FAA Administrator Michael Huerta. He described a “very aggressive and multilayered approach to ensure that we do not have cyber disruptions in our national airspace system” – one which undergoing a technological upgrade as we speak, via the Next Generation Air Transportation System, or NextGen. That system transforms air traffic control from a radar-based system with radio communication to a satellite-based one. NextGen is far more efficient. But some have questioned whether it is more vulnerable.

So then, can someone hack into an airplane? Huerta said that the FAA has seen no documented cases of an individual being able to hack into the core avionics systems.

“It’s not just the companies and their operating systems. It’s also the avionics systems in the aircraft themselves. We want to make sure that we have a very clear understanding of how those systems operate,” he said. “It wasn’t that long ago that all objectives in cyber were to keep the bad guys out. And I think we across industry generally have evolved to a different framework of thinking: let’s assume they may get in. It’s really a question of how do we respond to that.”

“All sectors have a long history of dealing with the privacy and financial consequences of cyberattacks,” said Steve Curren, acting director of the Division of Resilience in the Department of Health and Human Services Office of Emergency Management. “The emerging challenge for the health care and public health sector is the potential for cyberattacks that end up impacting patient care. As our dependence on technology increases and systems become more interconnected, we need to remain aware of the importance of good cybersecurity practices in keeping patients safe.

Actual health consequences of past attacks have often been either indirect or difficult to prove. Even Hollywood Presbyterian Medical Center, which earlier this year paid a hacker $17,000 in bitcoin to restore crippled systems, saw no impact on patient care.

But the potential is there: systems could be brought down in a similar ransomware attack, interfering with drug delivery and other vital systems. A hacker getting into drug development research could carry out competitive sabotage. Laboratory research in the wrong hands could squash a medical breakthrough or even arm terrorist for a biological attack.

“As a general matter, I don’t like to start from worst case scenarios. I try to work from bad scenarios that have a reasonable likelihood,” said Darren Lacey, chief information security officer and director of IT compliance for the Johns Hopkins University and Johns Hopkins Medicine. “I think you have to keep in the back of your head that something much worse could happen, but if you build your entire security program around that, it distorts the security program from the stuff that actually does happen quite a bit.”

The problem is one of complexity, as Curren describes it: The threats are as diverse as the number of organizations and systems they impact. And what Lacey has seen emerging in the last couple of years are directed attacks – where hackers come after an asset and then, after being blocked, come back again and again. It’s evidence that the health care industry, Hopkins specifically, has become a target.

“Attackers are sophisticated enough to know with some degree of persuasion what exactly they’re going after and that seems to be characteristic of state actors,” he said. “They’ve done their homework much more than in the past. It doesn’t change that that much how you defend it, interestingly enough, because you’ve still got to do the same things.  But you keep it in the back of your mind, ‘if I was a foreign state actor or a sophisticated cyber criminal, what would I be interested in?’ And you hope you guess right.”