THE REAL THREAT

Rosenberger fears the second scenario far more?cyberterrorist attacks that destroy critical data. And he’s not the only one.

The general state of data security is woeful, again, thanks to the Web. Despite unprecedented spending on security in the past three years, more hacks than ever are successful, they are easier to create and carry out, and they produce ever more devastating results. Most of those threats are not through disablement but rather corruption: tricking a system into doing the wrong tasks while it supposes it’s working normally.

Parasites?tiny computer programs that live in databases and slowly corrupt the data and its backups?could wreck a crucial database like Social Security. Or a hacker could penetrate a pharmacy chain’s network or hospital database, causing fatal medical errors when a patient takes a prescription drug. If you want to raise hell on airlines, you hack the reservation system, says Schneier. If you want to cyberterrorize airlines, you hack the weights and measures computers that control planes’ fuel and payload measurements.

Such "fringe systems" are seen as the most vulnerable to data corruption. "The threat to data is absolutely more of a concern," says Hager. "It’s so much easier to attack, and there are so many more targets."

In any case, the threat of cyberterrorism is deemed most plausible as a supplement to a larger terrorist attack. In other words, we shouldn’t think about cyberterrorism as the next great threat after the physical horror of airplane hijacking and the biological horror of Anthrax. Rather, cyberterrorism is something smaller that will be used to amplify those far greater horrors.

"I keep going back to Sept. 11 and wondering how bad it would have been if the Code Red worm hit at the same time?the level of anxiety and panic that would have caused," says Grey Global’s Cannon. "Having e-mail was one of the saving graces of that day."

The good news is that protecting against any security threat protects against cyberterrorism. Kenneth Niemi, CIO of the Minnesota State University System, learned that recently when he faced a two-and-a-half-week employee strike. It turned into a de facto antiterrorist exercise. Niemi found himself planning a defense against disgruntled employees who possessed the two keys to any security breach?knowledge and access.

Niemi’s greatest takeaway from this exercise was how much physical and IT security should and can intersect. (For more information on this, read "How to Plan for the Inevitable," Page 74.) Since Sept. 11, the trend toward combining aspects of IT security with onsite security has accelerated. "We made key card access enforceable 24 hours a day. We require certain employees to take their laptops home in case we need to deal with a situation remotely," Niemi says.