Joseph Giordano, director of the cybersecurity program at Utica College, discusses the state of cybersecurity in the U.S. Prior to joining the faculty, Giordano served as a program manager for the Information Directorate of the U.S. Air Force Research Laboratory. He is known nationally in the area of information and computer security.
Q- What do you see as the most pressing national security issues in the field of cybersecurity today?
Protecting the systems that are involved in our critical infrastructures is at the top of the list. Included in these systems are those that are involved in the financial sector, the power grid, and the oil and gas sector, amongst others. These systems are synonymous with our way of life and are essential to our economy and our national security posture. In addition, protecting the systems that are used in the military and in the Intelligence Community is of paramount importance.
Another area of importance for cybersecurity deals with coming up with ways to make sure that the cloud infrastructure is secure. The movement to the cloud model of computing comes with numerous cybersecurity challenges that need to be addressed. Addressing the cybersecurity issues associated with supply chains is a very important national security issue and is an enormous challenge.
Finally, we need to address the rash of data breaches that we continuously read about. Not only is valuable personal information being lost to these breaches but each data breach situation is costing millions of dollars.
Q- How vulnerable is the electric grid to cybersecurity threats?
The electric grid is one of the most critical infrastructures. Without power, the economy and the security of the nation will be adversely affected. From what one can read in the open source literature, the electric grid has been a target for some time. About two years ago there was an article in TIME magazine that reported that malware was found in the power grid. The other infrastructures have deep inter-dependencies based upon the power grid. A recent report by McAfee and the Center for Strategic and International Studies states that the power sector needs to do more in the area of cybersecurity.
Also, we need to make sure that cybersecurity is an integral part of the emerging Smart Grid. Cybersecurity for the Smart Grid (as with any system) needs to be thought about early and built into the system as early as possible. This is because it is a known fact that it is very difficult to address cybersecurity as an afterthought or to build security into a system after it has been built and fielded.
Q- How real is the threat of cyberwarfare?
There is no doubt that there is a threat out there and that the threat is very serious and very real. We face that threat every day of the week. From the standpoint of the countries that have capabilities to launch cyberattacks, they are very serious about it.
Q- Would you give an example?
Over the past few years North Korea has perpetrated cyberattacks against both South Korea and the United States. I think one of the most significant events that we have seen recently occurred during the 2008 conflict between Russia and Georgia. This conflict was an excellent worked example of what cyberwarfare techniques are capable of doing when combined with a physical attack. And most recently we have heard of Stuxnet and what it was capable of doing in the domain of industrial control systems. Stuxnet was an example of how cyber techniques can create effects in the physical world. I think that we have seen just the tip of the iceberg.
Q- What could be done to safeguard critical infrastructures against cyberattacks?
Make sure you have good security policies in place, bring in the best technology, use firewalls, and have intrusion detection and prevention systems in place. Proper use of encryption is critical. Use security technology properly and build good (assured) software that doesn’t have vulnerabilities and holes in it. And underneath all of this security education, training and awareness for users is a necessity, because a human is usually the weakest link in the chain. Finally, it goes without saying that we need more trained cybersecurity specialists.
Q- Do you think our state and local governments are prepared to combat cybersecurity threats?
I believe that all the states have some degree of preparation when it comes to defending against cyber attacks and for dealing with critical infrastructure protection and homeland security. It’s a matter of having the funds and having the expertise. As we all know, cybersecurity is a very complex problem and I think that the state governments are doing a great job getting their arms around the problem and putting together programs and initiatives to deal with the problem.
Q- Overall is there anything in the cybersecurity area that is not being looked at?
I would say more funding for research and development is needed, because R&D is where you are going to see those breakthroughs, and we need breakthroughs in the area of cybersecurity. In addition, much more needs to be done to educate users on what cybersecurity means and how to keep systems secure.
