Lights out? Cyber Threats to DOD Utilities

Nobody likes being in the dark. Some people invest in a generator or at least some candles for the occasional outage. But what if you’re the Department of Defense, and instead of bad weather knocking out the water or power, it’s a hack? For Cybersecurity Awareness Month, read on for what DOD is doing to protect its utilities from cyberattacks.

Power up

DOD has more than 500 major installations at home and abroad. These bases and other installations need reliable supplies of electricity, water, natural gas, and other utilities.
Industrial control systems help provide utilities when and where they’re needed. These are computer-controlled electromechanical systems that can, for example, open and close electrical switches and valves to operate heating and cooling systems.

According to DOD, these systems have become increasingly networked and interconnected with other DOD networks. While efficient, this puts them at risk of cyber intrusion or attack.

(Excerpted from GAO-15-749)

Shut down

Given the breadth of DOD’s utility systems, cyberattacks can do more than turn off the lights. According to officials from U.S. Cyber Command, a cyberattack on an industrial control system could destroy infrastructure.

How? Check out this video of a staged cyberattack conducted by the Department of Homeland Security and Idaho National Laboratory in 2007. It shows how a hack into the industrial control system of a diesel generator could cause it to self-destruct.

While the video shows a staged attack, these cyber threats are real. For example, energy, and water and wastewater sectors have reported multiple cyber incidents on their industrial control systems.

(Excerpted from GAO-15-749)

Keep out

DOD has updated its guidance to help keep cyber threats to its industrial control systems at bay, and the military services have taken steps to implement that guidance.
However, the services face 3 challenges as they work toward implementation:

1. Having a complete inventory of DOD industrial control systems. As of February 2015, none of the military services had such an inventory.
2. Finding personnel with experience in both operating and maintaining industrial control systems and cybersecurity.
3. Identifying funding to update current systems to the new cybersecurity standards and provide training, among other things. Officials from the Navy estimated the service would need “billions of dollars” for this over the next 10 to 20 years.

To help DOD avoid risks from delaying implementation of the guidance, we made multiple recommendations that DOD agreed with.

• Questions on the content of this post? Contact Brian Lepore at Leporeb@gao.gov.
• Comments on GAO’s WatchBlog? Contact blog@gao.gov.