Towards a Baltic Sea Region Strategy in Critical ... - Helsinki.fi

CRITICAL INFRASTRUCTURE PROTECTION IN THE BALTIC SEA REGION
Threats on the Underlying Information Infrastructure for CI
The system monitoring, control and status data gathering in most CI are now
automated processes with reduced reliance on human effort. These processes rely
on SCADA (Supervisory Control and Data Acquisition) networks that enable
communication with remote units using industrial protocols, such as, Modbus and
PROFIBUS (Process Field Bus). Traditionally, SCADA networks have been
considered to be closed networks and so security was not addressed in great depth
compared to conventional ICT systems.
However, recent trends have seen open standards and Internet technologies
being increasingly adapted in SCADA networks. This is partly driven by the need
to share up-to-date status data (e.g., with supply chain partners) and minimize
expenditures by, for instance, reusing corporate network infrastructure and leased
lines to implement parts of the SCADA network. Unfortunately, these measures
provide direct or indirect connectivity points to the Internet and other public
networks, creating a security gap that can end up compromising the systems
controlled by the SCADA networks (Graham and Maynor 2006). Many examples
exist of previous security breaches in SCADA networks. For instance, in March
2000, a disgruntled ex-employee in Australia repeatedly hacked into a sewerage
management system releasing over a million litres of raw sewage into public
places. And in January 2003, the Slammer worm disrupted SCADA traffic causing
operators to temporarily lose some degree of control of the Davis-Besse nuclear
power plant in Ohio USA. As a result, there is now increased acknowledgement of
the possibility external attacks on SCADA networks by CI owners, and a notable
surge in interest in SCADA systems by terrorists groups (Naedele 2007).
Recent information security trends in the BSR
Most of the nations of the Baltic Sea Region (BSR) epitomize what are known as
information societies, and their achievements in this regard are routinely used as
yardstick by other countries. This assertion is justified by the global rankings of
various ICT indices (e.g., Knowledge Economy Index 61 , Networked Readiness
Index 62 , ICT diffusion Index 63 etc.), where the BSR countries feature prominently
in top tier of the rankings. Paradoxically, highly advanced information societies
are usually left exposed to new kinds of vulnerabilities, as attested by the select
examples below describing in brief some realized information security threats in
the BSR.
• Example 1: Users of Nordea’s personal Internet banking service in several
countries in the BSR are regularly targeted by fraudulent phishing
of that spam is now image-rich e-mail spam message (about three times the size of a text only e-
mail spam), thus speeding up the exhaust of bandwidth and e-mail gateway capacities.
61 World Bank’s Knowledge Economy Index (KEI) evaluated based on variables representing
conduciveness of economic and institutional regimes; educated and skilled population; efficiency
of innovation environment; and use of ICTs.
62 World Economic Forum’s Networked Readiness Index (NRI) measures a country’s preparedness
to exploit the opportunities offered by ICTs.
63 United Nations Conference on Trade and Development’s ICT diffusion index (ICTDI) measures
a country’s penetration of ICTs (that is, mobile/fixed phones, Internet hosts and PCs) and it
affordability.
98 NORDREGIO REPORT 2007:5