In the electric power industry they can manage and control the  transmission and delivery of electric power, for example, by opening and  closing circuit breakers and setting thresholds for preventive shutdowns. In October 1997, the President’s Commission on Critical Infrastructure  Protection specifically discussed the potential damaging effects on the  electric power and oil and gas industries of successful attacks on control  systems. Moreover, in 2002, the National Research Council identified “the  potential for attack on control systems” as requiring “urgent attention.” In  February 2003, the President clearly demonstrated concern about “the  threat of organized cyber attacks capable of causing debilitating disruption  to our Nation’s critical infrastructures, economy, or national security,”  noting that “disruption of these systems can have significant consequences  for public health and safety” and emphasizing that the protection of  control systems has become “a national priority.”
Several factors have contributed to the escalation of risk to control  systems, including (1) the adoption of standardized technologies with  known vulnerabilities, (2) the connectivity of control systems to other  networks, (3) constraints on the implementation of existing security  technologies and practices, (4) insecure remote connections, and (5) the  widespread availability of technical information about control systems. According to the National Institute of Standards and Technology, cyber  attacks on energy production and distribution systems—including electric,  oil, gas, and water treatment, as well as on chemical plants containing  potentially hazardous substances—could endanger public health and  safety, damage the environment, and have serious financial implications,  such as loss of production, generation, or distribution of public utilities;  compromise of proprietary information; or liability issues. I will now discuss  potential and reported cyber attacks on control systems. Current Cybersecurity Technologies Have Limitations in Securing Control Systems

A significant challenge in effectively securing control systems is the lack  of specialized security technologies for these systems. Steps Can Be Taken to Strengthen Control System Security

Several steps can be considered when addressing potential threats to  control systems, including:
Researching and developing new security technologies to protect  control systems. Government and private industry have taken a broad look at the  cybersecurity requirements of control systems and have initiated several  efforts to address the technical, economic, and cultural challenges that  must be addressed.
Why GAO Did This Study

Computerized control systems perform vital functions across many of our nation's critical infrastructures. For example, in natural gas distribution, they can monitor and control the pressure and flow of gas through pipelines; in the electric power industry, they can monitor and control the current and voltage of electricity through relays and circuit breakers; and in water treatment facilities, they can monitor and adjust water levels, pressure, and chemicals used for purification. In October 1997, the President's Commission on Critical Infrastructure Protection emphasized the increasing vulnerability of control systems to cyber attacks. The House Committee on Government Reform, Subcommittee on Technology, Information Policy, Intergovernmental Relations, and the Census asked GAO to testify on potential cyber vulnerabilities. GAO's testimony focused on (1) significant cybersecurity risks associated with control systems; (2) potential and reported cyber attacks against these systems; (3) key challenges to securing control systems; and (4) steps that can be taken to strengthen the security of control systems, including current federal and private-sector initiatives.

What GAO Found

In addition to general cyber threats, which have been steadily increasing, several factors have contributed to the escalation of the risks of cyber attacks against control systems. These include the adoption of standardized technologies with known vulnerabilities, the increased connectivity of control systems to other systems, constraints on the use of existing security technologies for control systems, and the wealth of information about them that is publicly available. Control systems can be vulnerable to a variety of attacks, examples of which have already occurred. Successful attacks on control systems could have devastating consequences, such as endangering public health and safety; damaging the environment; or causing a loss of production, generation, or distribution of public utilities. Securing control systems poses significant challenges, including technical limitations, perceived lack of economic justification, and conflicting organizational priorities. However, several steps can be taken now and in the future to promote better security in control systems, such as implementing effective security management programs and researching and developing new technologies. The government and private industry have initiated several efforts intended to improve the security of control systems.