The nation’s utilities are at risk for cyber attack, the CIA’s top cybersecurity expert, Tom Donahue, told a gathering of utility security experts, The Washington Post reported this weekend. Attackers have hacked into utility companies’ computer systems overseas, in one case causing a power outage that affected multiple cities.

“We do not know who executed these attacks or why, but all involved intrusions through the Internet,” Donahue said at a trade conference in New Orleans. “We suspect, but cannot confirm, that some of the attackers had the benefit of inside knowledge.” The hackers are using the attacks to demand money from utilities.

Security experts said the CIA’s acknowledgement of the problem indicates how seriously they are taking it. CIA policy had been not to disclose such things. “The CIA wouldn’t have changed its policy on disclosure if it wasn’t important,” Alan Paller, research director at the SANS Institute, told the Post. “Donahue wouldn’t have said it publicly if he didn’t think the threat was very large and that companies needed to fix things right now.”

Concerns Not New

“These statements of threats and risks to the nation’s infrastructure are not
new,” Andrew Storms, director of security operations for nCircle Network Security, said in an e-mail. “In private meetings with the CIA and FBI, information-security personnel have heard time and time again that the nation’s utility systems are at risk and are a likely target by cyber attackers.”

The key concern with utility security is centered on so-called SCADA devices, Storms said. A SCADA system is a computer that monitors real-time controls for utility systems. “These are the computers that acquire data and control the physical workings of damns, power plants, water-treatment systems and almost every modern manufacturing plant,” Storms explained.

The problem is that utilities aren’t applying best-practices network security to these highly networked…