MIT Technology Review posted an article about the NSA’s Rob Joyce’s, chief of the NSA’s Tailored Access Operations unit, concern about internet security. He is worried about the Internet of Things .
Joyce said that the so-called “Internet of things” is a major boon when the TAO group needs to attack a target. He singled out heating and cooling systems as examples of Internet-connected devices that offer national-level hackers a route into organizations that computer network administrators often overlook. Joyce spoke at the Enigma security conference.
However, Joyce also said that the poor security of such devices is one of his primary concerns when it comes to the safety of U.S. networks.
However what is causing him real loss of sleep are SCADA systems or (Supervisery Control and Data systems)
“SCADA security is something that keeps me up at night,” said Joyce. He suggested that it might need new ideas from academia, which works on more fundamentally new ideas than industry, to improve the situation.
Nicholas Weaver, a computer security researcher at the International Computer Science Institute in Berkeley, California, who attended Joyce’s talk, said that he had correctly highlighted a significant problem, and an area where scary discoveries are easily made but possible solutions very scarce. “I don’t do SCADA research because I like to sleep at night,” said Weaver.
Researchers that do work on SCADA security have found evidence that there are groups trawling the Internet looking for industrial systems to infiltrate (see “Chinese Hacking Team Caught Taking Over Decoy Water Plant”). A recent report by the Nuclear Threat Initiative said that many nuclear power and weapons facilities are not adequately protected against computer-based attacks.
These are small remote small systems that control utilities, power grids, pipelines and among other things. Most use an unsecured web interface