![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_5b6166.jpg\")
<\/figure>\n\n\n\n[slide_text]\n<\/p>\n\n\n\n
Public Infrastructure Vulnerabilities<\/h1>\n\n\n\n
A draft copy of President Donald Trump’s executive order on cybersecurity leaked to the press<\/a> in late January. While the White House has denied the order came from the administration, it would require several cyber reviews the president promised on the campaign trail to undertake once in office.\n<\/p>\n\n\n\n One such review calls for a holistic report on U.S. vulnerabilities in cyberspace.\n<\/p>\n\n\n\n What areas might we expect to see listed when these vulnerabilities are reported? The following five targets face persistent threats from attackers domestic and abroad.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n The 9-1-1 emergency phone service is designated by the Department of Homeland Security (DHS) as one of 16 critical infrastructure sectors. According to the National Emergency Number Association, an estimated 240 million calls are placed to 9-1-1 annually. Approximately 70 percent of calls are made with wireless devices.<\/span> <\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Over the years, researchers have discovered vulnerabilities within the 9-1-1 service, most of which have been fixed. Yet threats against the service persist. If the 9-1-1 service went down, it would be difficult for people to receive timely response to emergencies by police, fire and medical professionals. <\/span> <\/p>\n\n\n\n [\/slide_text]<\/span> <\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Last year, security researchers at Israel’s Ben-Gurion University of the Negev’s Cybersecurity Research Center published a paper<\/a> on the U.S. 9-1-1 service’s vulnerability to distributed denial of service (DDoS) attacks. DDoS attacks use a network of compromised devices to flood a target with traffic \u2013 in this case, incoming calls to 9-1-1 from compromised cell phones. The researchers developed a rootkit to block tracking of compromised cell phones and then demonstrated several attacks, which could occur without knowledge by the phone’s owner. The researchers wrote that a network with as few as 6,000 compromised cell phones could be used to take down the 9-1-1 service across North Carolina for days. Just 200,000 compromised cell phones could be used to cause significant disruptions to the 9-1-1 service nationwide.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Energy infrastructure \u2013 including power generation, transmission and distribution assets \u2013 continues to be an attractive target for attackers who are intent on causing potential widespread disruption and serious economic damage.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Many security researchers focus on cybersecurity threats to energy infrastructure, especially as it becomes “smarter” via bidirectional communications and automation. Threats to industrial control systems (ICS) and supervisory control and data acquisition (SCADA) systems have also received much attention. Physical threats have received less attention but also exist, especially against distributed assets such as substations that are difficult to secure and monitor.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n On July 28, 2012, three activists \u2013 including an 83-year-old nun \u2013 climbed a hill on the perimeter of the Y-12 National Security Complex in Oak Ridge, Tenn. Using bolt cutters, the three made their way through four layers of chain-link fence protecting the largest store of weapons-grade uranium in the U.S. Once inside the fence where lethal force is utilized, they spray painted “Woe to an Empire of Blood” and splattered human blood on the white side of the facility. The three were discovered hours later and eventually arrested, charged and sentenced. The incident drew attention to physical security at the facility once called the Fort Knox for highly enriched uranium.\n<\/p>\n\n\n\n In a separate incident that occurred on April 16, 2013, snipers using military-style weapons attacked Metcalf substation in California. The attackers first cut fiber-optic cables and then opened fire on the substation. In all, the snipers damaged 17 transformers in an attack that cost $15 million in repair.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Everything is getting “smarter,” incorporating bidirectional communications and automation. Most have heard of the smart grid and smart cars, but companies now offer everything from smart juicers to smart toothbrushes \u2013 complete with Wi-Fi connectivity and a 10-megapixel camera.\n<\/p>\n\n\n\n And then there’s smart urban infrastructure. Smart infrastructure ranges from smart traffic signals to smart parking meters. But anything that’s smart is also hackable and therefore a potential target.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n The trouble with smart technology is that the very capabilities that make it smart also make it vulnerable. The threat to smart infrastructure stems partially from vulnerabilities in computers, network communications, ICS\/SCADA systems and digital components. Attackers could, for instance, wreak havoc on traffic patterns by remotely controlling traffic lights. To deal with these threats, the SysAdmin, Audit, Network and Security (SANS) Institute has developed a miniature-scale smart city to train<\/a> cybersecurity professionals to protect the smart cities of tomorrow.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Hackers attacked the Washington, D.C., closed-circuit camera network<\/a> on Jan. 12, just days before millions converged on the city for the presidential inauguration and protests. The ransomware attack affected 70 percent of the city’s cameras that monitor public spaces. The attack made it impossible for affected cameras to record public spaces between Jan. 12 and Jan. 15. A British man and Swedish woman were reportedly<\/a> arrested in the U.K. in early February in connection to the incident.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Dams may not be the first thing that comes to mind when imagining potential targets for hackers. But dams are one of DHS’s 16 critical infrastructure sectors. The ability to create a spectacle and potential widespread damage make them potential targets to hackers and terrorists.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Like distributed energy infrastructure and smart urban infrastructure, dams often use ICS\/SCADA systems. ICS\/SCADA systems are usually networked to enable remote monitoring and control of components.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n The Washington Post<\/em> drew fire late last year after it incorrectly reported that a dam in Vermont had been infiltrated by Russian hackers. Although the incident turned out to be false, the scenario is not unlikely or unprecedented.\n<\/p>\n\n\n\n In 2013, Iranian hackers with the Revolutionary Guard Corps temporarily took control of a 20-foot dam on Blind Brook near Port Chester, N.Y. The incident seems absurd \u2013 except that the same ICS\/SCADA systems used for this tiny dam in a sleepy subdivision of New York City are also used to monitor and control much larger dams throughout the U.S.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n While Russia may be embroiled in high-stakes espionage intrigue<\/a> right now, U.S. classified and sensitive information continue to be of interest to a variety of threat actors \u2013 from nation-states and terrorists to leakers and criminals.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Insiders are one of the biggest threats to any organization. Insiders have access to all sorts of sensitive information. Insiders easily bypass layers of security that external hackers must identify and infiltrate. While it could take external hackers months to identify a system hosting sensitive information and then get a password, an insider could achieve the same within minutes. Exfiltration from inside can be difficult to detect.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [slide]\n<\/p>\n\n\n\n [slide_text]\n<\/p>\n\n\n\n Edward Snowden is the most famous recent example of the insider threat, but the National Security Agency (NSA) has had more recent examples. Last August, another National Security Agency contractor with Booz Allen Hamilton was arrested and accused of “the biggest theft of U.S. classified information in U.S. history,” according to<\/a> the Washington Post<\/em>. Harold T. Martin III, 52, of Glen Burnie, Md., was arrested last year and indicted on Feb. 8<\/a> on 20 counts of willful retention of national defense informaiton. Martin is alleged to have taken 50 terabytes of digital data and 75 percent of the tools developed by the NSA’s elite Tailored Access Operations (TAO), which conducts cyber espionage on foreign targets. Like Snowden’s case, the Martin case illustrates the ongoing threat posed by government employees and contractors.\n<\/p>\n\n\n\n [\/slide_text]\n<\/p>\n\n\n\n [\/slide]\n<\/p>\n\n\n\n [\/slider]<\/p>\n","protected":false},"excerpt":{"rendered":" The targets, threats and real-world examples that should be included in President Trump’s review of cyber vulnerabilities.<\/p>\n","protected":false},"author":7,"featured_media":55535,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_meta-robots-noindex":"","_yoast_wpseo_meta-robots-nofollow":"","_yoast_wpseo_canonical":"","_acf":"","_yoast_wpseo_primary_category":29,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","_smg_distribution_targets":[]},"categories":[106,31,33,17],"tags":[],"coauthors":[1111],"class_list":["post-19022","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-daily-brief","category-home","category-newsletters","category-multimedia"],"acf":{"subheadline":"","legacy_arc_id":"EZ7QIHNM4RCFNPHR3Z763Z6KXE","arc_canonical_url":"\/home\/2017\/02\/26\/5-vulnerabilities-that-should-be-in-trumps-cyber-review\/","remove_feature_photo":false,"is_sponsored":false,"subtype":"","redirect_url":"","disable_inline_ads":false,"native_logo_pretext":"Presented By:"},"yoast_head":"\n![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_a4fb77.jpg\")
<\/figure>\n\n\n\nEmergency Services: The Target<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_5a77ee.jpg\")
<\/figure>\n\n\n\nEmergency Services: The Threat<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_f83f0f.jpg\")
<\/figure>\n\n\n\nEmergency Services: Example<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_f260eb.jpg\")
<\/figure>\n\n\n\nEnergy Infrastructure: The Target<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_9c9bc7.jpg\")
<\/figure>\n\n\n\nEnergy Infrastructure: The Threat<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_1f05df.jpg\")
<\/figure>\n\n\n\nEnergy Infrastructure: Example<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_d5aee9.jpg\")
<\/figure>\n\n\n\nUrban Infrastructure: The Target<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_c2be0d.jpg\")
<\/figure>\n\n\n\nUrban Infrastructure: The Threat<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_a3c811.jpg\")
<\/figure>\n\n\n\nUrban Infrastructure: Example<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_26e615.jpg\")
<\/figure>\n\n\n\nDams: The Target<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_fdb327.jpg\")
<\/figure>\n\n\n\nDams: The Threat<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_e9ec56.jpg\")
<\/figure>\n\n\n\nDams: Example<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_47529d.jpg\")
<\/figure>\n\n\n\nClassified\/Sensitive Government Data: The Target<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_3fe807.jpg\")
<\/figure>\n\n\n\nClassified\/Sensitive Government Data: The Threat<\/h2>\n\n\n\n
![\"\"](\"\/wp-content\/uploads\/2026\/08\/Slide1-1.jpg_8db8fd.jpg\")
<\/figure>\n\n\n\nClassified\/Sensitive Government Data: Example<\/h2>\n\n\n\n