Robert Siciliano, a security expert at Hotspot Shield, discusses ISIS's stated plans to launch cyberattacks against the U.S. He breaks down vulnerable targets like the power grid, water systems, and financial networks, and compares ISIS's capabilities to state-sponsored and criminal hackers.
Chapters
Welcome back. ISIS is looking to get more creative and to find a new way to create havoc in the United States. Terror group reportedly looking to increase its capabilities to carry out a cyberattack on the U.S. But what would that look like, and do they even have the capacity to pull it off? Well, earlier today I spoke with Hotspot Shield security expert Robert Siciliano about that and much more. Robert, thank you for a few minutes. I appreciate it.
Thank you.
Well, first off, before we get into their capacities, talk about our vulnerabilities. Just how vulnerable on a national level or even a major, let's say, hard capacity target, how vulnerable are we in the US to cyberattacks?
So I think that, you know, the ambition might be there for them to attack us, but in what, what does that actually mean? An attack that would actually harm or hurt us would be one that would attack our critical infrastructures, such as going after our power, electricity, water supplies, and so forth. That would, uh, cause catastrophic damage if in fact they were successful. The likelihood of them being successful, well, that's another story.
Well, talk about, um, some of the targets. I keep hearing about the grid, um, and our vulnerabilities. Talk about what that would look like and also, if successful, what that could mean just to day-to-day life in the US.
So a few years back, uh, it was a number of years ago at this point, uh, New York and a certain part of that region had gone dark for quite some time, for hours at a time. And you saw, you know, many people were walking out of New York City because the transit system wasn't working. Uh, and when that happens, you know, when there's no power, there's no gasoline pumps, uh, no transit, there's no, uh, you know, the tolls don't work, there's no lights on and so forth, no refrigeration, restaurants can't cook food, the power is out in all the supermarkets and so on, it can wreak an awful lot of havoc in a short period of time. Some studies show that, you know, less than 3% of all society doesn't have enough food stores for a whole week. So when the power goes down, you know, The society will not survive for too long.
You also mentioned water, but I've heard other things of considerations which were attacks on the financial systems writ large. Also, you know, targeting, let's say, air traffic control or major transportation communiques. Give an idea— you're much closer than the rest of us— just how vulnerable are we in those, the grid? Have we beefed up our security that we should be comfortable as Americans, or should be we worried that we still aren't nearly where we need to be?
So security is never 100%. It's always a work in process. You know, security, they say, is a journey, not a destination. So you never fully arrive. And the US has been under attack for many years, actually. We're under attack right now as we speak. You know, there are many organizations out there that want to take us down. The US military and others are fighting cyber attackers on an ongoing basis. So the fact is, you know, the good guys currently are winning. Obviously the lights are on, things are working, transportation is functional. But, you know, there's always the possibility that the bad guys could win in a way where they find some form of vulnerability, they sneak in, they plant a virus of some kind, and we go down for a period of time. Completely wiping out our finances, completely wiping out our grid would be very, very difficult for them to do. Is it possible? I guess it's possible, But I would say that it's more of a likelihood that some type of a solar flare will knock out the grid before ISIS does.
To that end, talk about the bad guys a little bit, Robert, in that should we be most focused with the terror organizations, or is it industrial espionage, or people from— whether it be Eastern Europe or other parts of Asia that are the bigger worry? Where is, from the government's perspective, the worst concentration of bad guys and their capacities?
So state-sanctioned hacking, I would say, is more of a threat, meaning that you have, um, you know, those that work on the inside of government agencies that have unlimited time, unlimited resources, and they've been doing it for years. And they are— they have been doing it for years. You know, we saw recently that, um, uh, you know, a number of Chinese military Personnel were indicted by the U.S. government. That was a few years back. And, you know, they're still under indictment, essentially. And that being said, you know, ISIS at this point has significant resources. But, you know, for them to accomplish what they say that they are going to accomplish would be very difficult. It would be amazing if they could. But you also have, you know, many security professionals here in the U.S. That are battling evil 24/7, 365. And for ISIS to accomplish something significant at this point in time, I think would be unlikely.
How about industrial espionage? Not state-sanctioned, but professional groups of hackers, obviously, that aren't bound here by geography, but maybe at least share the same intent, and that's to create havoc.
Well, there have been many reports of criminal hackers getting inside access to numerous government systems, Norwegian utilities, you know, whether it's water or electric and so on, you know, they have been successful getting blueprints and so on. So many of them have already achieved the goal of getting access inside these systems, but they haven't actually effectively taken any of them down. Which, so knowing that they have had access, But also knowing that they haven't been successful in wreaking any havoc means that they haven't executed, you know, what they may have accomplished or attempted to do. So, but when government agencies and corporations see this type of industrial espionage, they tighten their systems up. They separate them from the internet as a whole. They make it much more difficult for bad guys to accomplish anything nefarious in the future. So, you know, right now we seem to be winning this battle, but, you know, there's always the chance that they could still get in.
Well, it is a feeling that this is a fight that is in the first few rounds here, and with new technology obviously and some strange agendas out there in the world, certainly an issue we'll continue to talk about. Robert Siciliano, thank you very much for a few. I appreciate it.
Thank you so much.
All right, coming up next, everybody, we switch gears. Star Wars, you know, is getting all the attention and love at the box office, setting records, but it is hardly the only movie playing out there and certainly not the only good option you have to choose this holiday season. Columnist Michael Musto, he's gonna join us next, take a look at the films getting the most Oscar buzz.
