Back several months ago I posted my thoughts on the Global Megatrends in Cybersecurity 2015 survey which in short found that 78% of the 1,000 respondents say their organization’s board hasn’t been briefed about its cybersecurity strategy within the past year, while two-thirds say top executives haven’t made information security a priority. While 78% is alarming, it is not, unfortunately, surprising. Fast forward the clock to December 2015 and on the front page of the Dallas Morning News is an article about foreign hackers having gained access to the U.S. power grid. While there may be some who read my post and the article and their jaw hits the floor, the vast majority will not as it is pretty common knowledge among IT professionals around the world that hackers from Iran, Russia and China have successfully penetrated the U.S. power grid over the years and most likely stowed away malware of various types. And those are the countries the Feds have acknowledged. Some of you may ask yourself the question, why would a country even care about the U.S. power grid? Come on now, seriously? Answering that question in the most simplest way is for a number of geopolitical reasons and most ultimately power. Some of you may find yourself asking yourself the question if the U.S. government knows about the power grid issue, why don’t they just “remove their access?” Huh, seriously?!?! And if you want to see the somewhat fictionalized and Hollywood version of why another country would care about the U.S. power grid, or why hackers do what they do watch Mr. Robot on the USA Network (season 2 coming the summer of 2016 and yes I am a self-admitted junky). Another point brought up in the article is the foreign hack on the energy company Calpine based here in the U.S. According to the article, the hackers found valuable information stored on SEVEN UNENCRYPTED FTP SERVERS REQUIRING NO AUTHENTICATION TO ACCESS details about the company’s plants. Jumbled in the folders was code that could be used to spread malware to other companies without being traced back to the attacker’s computers, as well as handcrafted software designed to mask the internet protocol addresses they were using were in Iran. As Deputy Energy Secretary Elizabeth Sherwood Randall said in a recent speech “If we don’t protect the energy sector we are putting every other sector of the economy in peril.”
