A survey of 600 computing and computer-security executives in 14 countries suggests that attacks on the Internet pose a growing threat to the energy and communication systems that underlie modern society.
The findings, issued Thursday by the Center for Strategic and International Studies and the computer-security company McAfee, echoed alarms raised this month by Google after it experienced a wave of cyberattacks.
"One of the striking things we determined is that half of the respondents believe they have already been attacked by sophisticated government intruders," said the study's director, Stewart A. Baker. "It tells us that this is a serious problem right now."
More than half of the executives called their own nation's laws inadequate for deterring cyberattacks. Half identified the United States as one of the three most vulnerable countries; the others were China and Russia.
Moreover, the United States was identified most frequently as a potential source of cyberattacks.
"When they were asked which country 'you worry is of greatest concern in the context of network attacks against your country/sector,' 36 percent named the United States and 33 percent China -- more than any other country on a list of six," the report said.
China's security measures also came in for praise from the executives.
"It was striking how much of an outlier China is on a number of measures," said Mr. Baker, a Washington lawyer who formerly served as assistant secretary for policy at the Department of Homeland Security and as general counsel for the National Security Agency. "They have confidence in their government, and they are adopting security measures at a higher rate than other countries."
The report focuses on "critical infrastructure" -- essential networks and services that include the financial system, transmission lines for gas and electricity, water supply, and voice- and data-communication networks. At the heart of these systems are networks known as Scada systems, which are the basis for manufacturing, power generation, refining and other basic operations in advanced economies. (The acronym stands for supervisory control and data acquisition.)
The increasing use of Internet-based networks "creates unique and troubling vulnerabilities," the report says. In the past, the data used by such industrial systems was largely carried on proprietary networks that were often better insulated from the outside world.
The advantage of the Internet lies largely in the lower cost of developing systems because of the low cost of commodity products. But the report's authors stopped short of calling for a complete separation between those systems and the open Internet.
"Remote access to control systems poses a huge danger," said Phyllis Schneck, McAfee's vice president for threat intelligence. "We must either protect it appropriately or move it to more private networks and not use the open Internet."
The report found considerable pessimism among the executives, whose responses were anonymous.
"Remarkably, two-fifths of these I.T. executives expected a major cybersecurity incident (one causing an outage of 'at least 24 hours, loss of life or ... failure of a company') in their sector within the next year," the report said. "All but 20 percent expected such an incident within five years. This pessimism was particularly marked in the countries already experiencing the highest levels of serious attacks."
First Published: January 29, 2010, 7:00 a.m.
