Expect Cyber-Catastrophe, Says Bush Advisor

NEW YORK -- In his keynote address at an information technology auditing conference here, Howard Schmidt, President Bush's advisor on cyber-security, predicted that networks operated in the United States and abroad are likely to be brought down by catastrophic events unless security greatly improves.

"By 2009, there will be over 2 billion Internet-enabled devices, each with an IP address, in the U.S. alone, and 6 billion altogether," predicted Schmidt, vice chair of the President's Critical Infrastructure Protection Board, in his keynote before the 30th annual international conference of the Information Systems Audit and Control Association (ISACA). The conference was attended by nearly 300 security professionals from 37 countries.

The devices on the IP packet-based network of the future will include not just computers, but also traffic lights, elevators, appliances, and even pacemakers, Schmidt said. But the IP networks of 2009 will be unstable, subject to "constant security outages," unless both governments and private industry focus on eliminating network vulnerabilities through research and better practices.

"The routing tables of the future will be unmanageable; there will be slowdowns and failures, and malicious and criminal activity between 2002 and 2009 all mean the Internet quits working," Schmidt warned. He even forecast a future in which "special aircraft will be flying the routing tables" physically to servers after periodic network brownouts.

In addition, computer viruses, the "zero-day viruses and affinity worms," will be surreptitiously entering IP devices, causing widespread devastation by wiping out business records.

"In a major brokerage house, it will enter through the CEO's house by infecting the CEO's PC, then the corporate network, and scrambling the brokerage house trading records," Schmidt said. He was chief of security at Microsoft before joining the President's Critical Infrastructure Protection Board in December.

Schedule of a Breakdown

Electrical power grids, controlled by networks, could collapse in 2005 due to distributed denial-of-service attacks that block traffic to IP-based management devices, Schmidt said. Economically, all these disruptions will take a toll by 2009, with the Federal Reserve coming to the conclusion that cyberattacks are depleting growth. Then, Fedwire, the government-run network for monetary transfers to banks, will be hit by a database scrambler attack and there will be an unscheduled bank holiday to clean up the mess.

"That's where we're headed if we don't turn this ship around," Schmidt warned.

The federal government is monitoring a situation that arose during the past year in which it was discovered that vulnerabilities in the Simple Network Management Protocol (SNMP) would allow attackers to take over SNMP-based routers, switches, applications, and firewalls. This vulnerability, detailed by Finnish researchers, has been traced back to what's called ASN.1 encoding, which caused dozens of network and applications vendors to issue software patches in a race to fix networks before hackers exploited the vulnerability.

ASN.1 constitutes a layer of network coding that is used in many network protocols other than SNMP, and there are suspicions that implementations of ASN.1, which Schmidt likened to "a bad gene in the DNA of complex programs," may be at risk as well.

So far, Schmidt disclosed, the ASN.1 buffer-overflow vulnerability has also been discovered to affect telecommunications microwave equipment, which the industry has quietly addressed. "We're monitoring that," Schmidt said.

Industry Cooperates

Working with industry, the government has wanted to keep information about major vulnerabilities quiet until industry had the needed remediation prepared.

For that purpose, the Bush administration is supporting legislation that would somewhat restrict the Freedom of Information Act, which allows individuals to petition for release of government-held documents, by exempting federal agencies from releasing information about security vulnerabilities disclosed by industry to government. The goal is to establish what's now being called the "Cyber Warning and Information Network" between government and industry to share information about serious security threats quickly. "We want a limited FOIA exception for this," Schmidt said.

The 20-member President's Critical Infrastructure Protection Board, created by President Bush last October, is the organization expected to coordinate security strategies with both agencies and private-sector companies. Its concerns cover the safety, both physical and electronic, of industry sectors that include telecommunications, energy, transportation, banking, health care, manufacturing, and water systems.

The board expects to publish its cyber-strategy report on September 19, initially to ask for public input on its recommendations. These recommendations are expected to include a statement of "best practices" for federal agencies, asking them to adhere to guidelines for security auditing, vulnerability assessment, intrusion detection, and other tasks, Schmidt said.

In addition, the report will recommend proposed research areas where more work needs to be done to improve the Internet's somewhat shaky foundation, particularly as pertains to older protocols such as Domain Name Server and Border Gateway Protocol.