Archive | Original Site

Foreign intelligence agents critically infiltrated systems that operate critical U.S. infrastructure, and left behind malicious software that could disrupt and endanger the day-to-day lives of Americans, the Wall Street Journal reports.

The paper cites anonymous current and former U.S. intelligence officials in its report. The spies are reported to have been agents of China, Russia, and various unnamed other countries. The officials said that the intruders was a mission to map the U.S. electrical grid and other critical infrastructure, and to cultivate the capability to disrupt that infrastructure during a crisis. I’m certainly not surprised, and U.S. agents have probably done the same thing to other countries.

In my reporting for SD Times, I have spoken with companies that develop software according to the US National Security Agency’s Common Criteria Evaluation Assurance Level (EAL) program. EAL is an initiative operated by the National Security Agency to help industry create secure software, and classify existing software. The program is a relatively new public initiative that was born out of the “orange book,” the U.S. military’s once closely guarded guidelines for software security.

To date, only Green Hills Software, a company that develops a specialized operating system called Integrity, has received an acceptably high score on the EAL to address the problem. The NSA is also sponsoring secure programming classes at public universities.

Why is the NSA involving itself in the private sector, you may ask? It needs help. In a recent interview, Rex Black, president of Rex Black Consulting Services, explained to be how software engineers are essentially playing a game of multidimensional chess against hackers.

Black said that a big part of the problem is that modern operating systems (and that includes open-source ones) are constantly evolving and contain tens of millions of lines of code. It is only a matter of time until a defect slips by and is discovered by cybercriminals–or spies – even when the best development practices are followed.

And the technological environment in which an operating system exists is constantly in flux, making it nearly impossible to foresee threats that do not presently exist, but might exist in the future, Black said.

People involved with the EAL effort have told me just how poor the state of infrastructure security is. But fear not, in my research, security industry executives and an NSA official have assured me that President Obama “gets it.”

The reality is that there is an infrastructure crisis, and the WSJ’s hacking report, while troubling, is only a symptom of what ails us. The American Society of Civil Engineers has spent much of the past decade grading the nation’s infrastructure, only to be ignored.

This year, the engineers give the U.S. an overall grade of a D, and estimate that it will take an investment of several trillion dollars to bring states up to code. The stimulus package only goes a small way toward meeting those needs.

It’s time for the U.S to get serious about infrastructure, and yes, it costs money to do these things. That could even require –gasp~-a tax hike to pay for our safety. The work needs to be done, and is long overdue.