{"id":12511,"date":"2016-04-08T15:01:07","date_gmt":"2016-04-08T15:01:07","guid":{"rendered":"https:\/\/one.sightlinemg.com\/federaltimes\/uncategorized\/2016\/04\/08\/internet-of-things-when-cyberattacks-have-physical-effects\/"},"modified":"2026-08-08T04:32:09","modified_gmt":"2026-08-08T04:32:09","slug":"internet-of-things-when-cyberattacks-have-physical-effects","status":"publish","type":"post","link":"https:\/\/one.sightlinemg.com\/federaltimes\/opinions\/2016\/04\/08\/internet-of-things-when-cyberattacks-have-physical-effects\/","title":{"rendered":"Internet of Things: When cyberattacks have physical effects"},"content":{"rendered":"\n

New risks accompany the Internet of Things (IoT).\u00a0Software attacks that produce physical effects are especially troubling.<\/p>\n\n\n\n

Take the Bowman Avenue Dam attack, as an example.\u00a0On March 24, 2016, the Department of Justice announced charges against an Iranian hacker who mounted a cyber-physical attack upon the supervisory control and data acquisition (SCADA) systems of the Bowman Dam, in Rye, New York.\u00a0The charges are that the hacker repeatedly obtained information regarding the status and operation of the dam, including information about the water levels and temperature, and the status of the sluice gate, which is responsible for controlling <\/span>controls water levels and flow rates.\u00a0The hacker obtained access that, ordinarily, would have enabled him to remotely operate and manipulate the dam\u2019s sluice gate.\u00a0Fortuitously, the gate had been manually disconnected at the time of his intrusion.<\/p>\n\n\n\n

This is a real-time example of exactly the kind of IoT risks that I\u2019ve discussed in my two previous blogs for Federal Times.\u00a0In the first blog<\/a>, http:\/\/www.federaltimes.com\/story\/government\/solutions-ideas\/2015\/12\/11\/how-iot-poses-security-risk-our-critical-infrastructure\/77152806\/<\/a>, Dec. 11, 2015,<\/span> I observed that “cyberattacks upon the IoT can produce adverse consequence upon physical systems that are IoT endpoints.”\u00a0 Had the Bowman Dam sluice gate not been down for maintenance, the Iranian attacker could have opened the gate and produced flooding.\u00a0<\/p>\n\n\n\n

Federal officials, especially those at the Department of Homeland Security, are alert to cyber-physical threats to SCADA systems that control critical infrastructure.\u00a0With the proliferation of IoT instrumentalities, we can expect greater interconnectivity and integration among control systems and controlled equipment.\u00a0IoT endpoint devices will be employed for many purposes, including “informational” functions (e.g., status reports on condition and capacity) and those for “control” (e.g., activation\/deactivation).\u00a0Distinct to the now-emerging IoT “4th generation” of SCADA systems, control functionality will be increasingly automated with decisions made on a machine-to-machine basis, without human intervention.<\/p>\n\n\n\n

From the federal perspective, the IoT promises optimization of infrastructure operations through interconnected SCADA systems.\u00a0 If properly implemented, conceivably security can be enhanced as IoT systems can accelerate receipt of information on system status and facilitate rapid response to either cyber or physical threats.\u00a0 However, as I commented in my second blog<\/a>,http:\/\/www.federaltimes.com\/story\/government\/solutions-ideas\/2016\/02\/04\/reconciling-risk-and-value-internet-things\/79826836\/<\/a>, Feb. 10, 2016,<\/span>\u00a0 “authentication, identity management and transaction processing add to exposed [attack] surfaces” for IoT systems.\u00a0Positive security results for IoT-enabled SCADA systems will have to be achieved through a collaborative effort of federal authorities with relevant standards setting organizations (SSOs)<\/span>, network architects, system engineers, equipment manufacturers, infrastructure operators,<\/span> and technical cyber specialists. \u00a0\u00a0<\/p>\n\n\n\n

DHS leads the federal government\u2019s efforts to address the cybersecurity of critical infrastructure.\u00a0DoD has recognized its need to protect the cybersecurity of the manufacturing capabilities of the defense industrial base (DIB)<\/span>.\u00a0Advanced manufacturing capabilities rely upon Industrial Control Systems (ICS).\u00a0If we think of SCADA as large-scale control systems that typically cover a broad geographic area and multiple-site infrastructure systems (e.g., dams and irrigation, pipelines), ICS may be considered a subset of SCADA that refers to industrial automation and is more site-specific.<\/p>\n\n\n\n

IoT instrumentalities will create new vulnerabilities for connected ICS.\u00a0Endpoint devices would monitor equipment condition and utilization, for example.\u00a0Resource allocation could be accomplished through communication of “status” to the host service (at the core),<\/span> or by peer-to-peer communication around the periphery of connected devices.\u00a0Equipment could receive software updates or scheduled service based upon the condition and utilization reports.\u00a0While these “conditions” can exist today, with the advent of IoT the quantity of at-risk equipment will increase as will the number and diversity of industries using connected devices.\u00a0The scale of the prospective “industrial IoT” elevates the cybersecurity risk to the advanced manufacturing capabilities of the defense industrial baseDIB<\/span>.<\/p>\n\n\n\n

The risk is a function of threat, vulnerability and consequences of cyber-physical attacks:<\/p>\n\n\n\n