Cyber Crime and Cyber Terrorism

23
 
Organizational aspects not learned from previous ICT innovation cycles
In parallel, ICT found its way in the automation of physical and real-world processes 
such as in the chemical industry, switching of rail points, and the control of the power, 
gas and water grids. The Supervisory Control And Data Acquisition (SCADA) and sim-
ilar process control protocols were designed without many security considerations. The 
software was proprietary and no one else was interested in its detailed working. The pro-
cess control networks were closed, therefore no hackers would have access. The same 
manufacturer root password which one could not change was embedded in thousands of 
units all over the world. The Stuxnet case was a case in making use of such a design and 
deployment error (
Falliere et al., 2010
).
The design, implementations of SCADA protocols and the protection of systems 
in the field did not keep pace with the security considerations ahead of their field. 
Connectivity with public networks, ease of teleworking, and tools like Shodan which 
identify vulnerable process control systems connected to the internet create the ac-
cess paths for cyber criminals to critical infrastructures such as our energy grids 
(
Averill and Luiijf, 2010
).
Only some years ago, testing a SCADA network with the ICT-network tool Nmap 
at a large inhomogeneous SCADA installation caused one-third of the SCADA im-
plementation to crash and another one-third to stop communication. The SCADA 
protocol implementations could not deal with an unexpected byte more or less in a 
received packet. It failed to validate the received protocol packets as the implementa-
tion expected a benign operating environment.
These are just some examples of ICT innovations and adaptation cycles where 
the system designers did not properly take security considerations into account and 
the programmers failed to learn from cyber security lessons identified in earlier ICT 
adaptation cycles. Failing to protect against buffer overflows, no input validation, 
not cleaning of sensitive information from re-usable memory buffers, and embed-
ding system passwords are just some examples of errors—and thus disguised old 
threats—that occur over and over again with each ICT innovation cycle.
Moreover, new ICT-functionality itself provides unknown backdoors. For exam-
ple, new versions of Programmable Logic Controller (PLC) boards nowadays may 
contain an embedded web engines. Often such new PLC boards replace old defective 
PLC boards. The new functionality, however, allows access to all PLC functions un-
less someone takes the time to lock the web interface entry.
More examples of these and other threats to process control systems can be found 
in 
Luiijf (2010)
.