Search

Cybersecurity is often overlooked in protecting a critical facility and the ratepayers' investment. This threat of a cyberattack on critical infrastructure is relatively new. Malware, the umbrella title given to malicious software of all stripes, can do much damage. Until recently, it was a misbegotten belief that software could harm only software; this is not so. Early DOS-based software could destroy hard drives, and it will be shown how manipulation of SCADA and networked programmable logic controllers can cause real physical damage to controlled machinery. In recent years, high-level hackers, working with nation-states and government agencies, have rigorously investigated software for flaws unknown to anyone, exploiting these flaws for espionage or general mayhem. So it is that our industry, which is increasingly relying on automation to manage rising costs and more stringent regulations, has turned to securing SCADA and other process control systems. Should such a system become compromised, the conditions for mayhem and social disruption are an opportunity for hackers. This paper provides a general overview of what could well become a major advanced persistent threat that will affect a broad class of facilities, and a few highlights illustrating the problem of protecting critical infrastructure against such a threat. Basic suggestions for site hardening are offered and recommended. [ABSTRACT FROM AUTHOR]

This study demonstrates that consumers, healthcare workers and corporate America are still very much vulnerable to simple social engineering attacks, even with current levels of security training. Through a simulation of what a real social engineer might try to do (with a few safeguards to protect participants) security levels were tested in the business district of a large downtown financial center, a hospital, and a university campus. Through the simulation attack, researchers were able to get useful demographic and tactical information from the majority of the victims. In addition, 73% of respondents shared a password with the researchers. Those with recent security awareness training were just as likely as those without to share their passwords with strangers. Results, implications and future directions are discussed [ABSTRACT FROM AUTHOR]

The article profiles Kevin Mitnick, the most notorious computer hackers in the U.S. It mentions that Mitnick uses what is known as "social engineering" to accomplish his crimes. He serves four and a half year in prison pre-trial before he agreed to plead guilty to wire and computer fraud. He owns Mitnick Security Consulting LLC, an information security consulting firm based in Henderson, Nevada. He suggests not following his footsteps, noting that there are definitely other roads or other opportunities that people can learn and educate themselves about hacking, security, and pen testing.