CYBERSECURITY - The Truth About Cyberterrorism

1 2 Page 2
Page 2 of 2

The good news is that protecting against any security threat protects against cyberterrorism. Kenneth Niemi, CIO of the Minnesota State University System, learned that recently when he faced a two-and-a-half-week employee strike. It turned into a de facto antiterrorist exercise. Niemi found himself planning a defense against disgruntled employees who possessed the two keys to any security breach?knowledge and access.

Niemi’s greatest takeaway from this exercise was how much physical and IT security should and can intersect. (For more information on this, read "How to Plan for the Inevitable," Page 74.) Since Sept. 11, the trend toward combining aspects of IT security with onsite security has accelerated. "We made key card access enforceable 24 hours a day. We require certain employees to take their laptops home in case we need to deal with a situation remotely," Niemi says.

Niemi also formalized the process of registering guests who enter his building and is adding computer lab surveillance.

Cannon has also tightened physical security by revoking several employees’ access to the data center. He also moved many consoles out of the data center, all in an effort to reduce traffic near critical systems.

The MWRA already has tight integration of physical and network security. To begin with, the computers are in a locked room, which is accessible by key card and manned 24/7. Visitors check in and check out at the front desk, and after visitors leave, their host sends a memo to senior management detailing the visit.

SCADA connects through a private line (soon, via microwave) to pump stations and reservoirs. If something goes wrong at a water facility, an alarm sounds both onsite and at the SCADA operations centers. The alarm also flashes on the computers, and it can’t be shut off until a formal acknowledgement of the alarm is made and physically logged by a person with clearance to do so.

"Roving crews" periodically go to MWRA pump stations and storage sites to check the integrity of the facilities and their connection to the control computers. Most of the sites are under surveillance.

"I see IT and these physical security rules meshing more and more," says Cannon. "Especially when you talk about disgruntled employees and screening. But it’s a fine line. We want to treat employees like adults. Cut off too much access and you’re saying you don’t trust them."

Besides meshing physical and IT security, two other measures CIOs can take are to get involved and share information with each other. Joining Cannon in the Information Civil Defense Group, meeting with government groups like the National Infrastructure Protection Center, raising awareness of the cyberterrorist threat within one’s own company and opening security dialogues with peers are all important steps to take.

Six months after the Sept. 11 attacks, there’s a great deal of optimism among technology professionals about their ability to deflect the cyberterrorist threat.

"[Awareness] is a big reason for optimism," says Alan Paller, security expert and director of research at the SANS Institute in Bethesda, Md. "The operations guy is getting a call from the vice chairman, someone really high up, who’s asking what the company is doing about this threat. That conversation has never happened before. Underneath there are still a lot of vulnerable systems out there, but I believe cyberterrorism is very hard to pull off.

"My newest speech is about this topic, and it’s not ’look how life is ending,’" Paller adds. "It’s optimistic. There are many more reasons for optimism now than there were six months ago."


Copyright © 2002 IDG Communications, Inc.

1 2 Page 2
Page 2 of 2
Get the best of CIO ... delivered. Sign up for our FREE email newsletters!