Media reports about a cyberattack that forced a British power plant offline for four days should be taken seriously far beyond the United Kingdom. It gives us a glimpse of how the Iran conflict could develop and signals to governments and businesses around the world that they need to be ready for a new battlefield. The facility reportedly targeted by Iran-linked hackers was relatively small, and the British government has stressed that there was no risk to the wider energy system.
That is important context, but it would be a mistake to judge the significance of this attack purely by how much electricity was lost. The question for every country operating critical infrastructure is what happens when the target is bigger. We have already seen reasons to be concerned elsewhere as well.
Water and wastewater systems across at least 12 states in the United States have recently reported cyberattacks. More than 30 community water systems were affected in Minnesota alone. In Georgia, one incident caused a drop in water pressure and led to a boil-water advisory.
The US government has not publicly accused Iran of the attacks, but reports point to a hacker group linked to the Islamic Revolutionary Guard Corps (IRGC). These incidents mark an important shift in cybersecurity. For years, much of the public conversation around cyberthreats focused on data.
People understood that hackers could steal passwords, empty bank accounts, leak personal information or lock a company out of its computer system. Critical infrastructure creates a very different risk because the systems being attacked control parts of the physical world. For societies to function, electricity has to be generated and distributed, water has to be pumped and treated, transport networks have to operate and telecommunications have to stay online.
Increasingly, technology sits underneath all of these systems. That technology creates enormous efficiencies, but it also creates opportunities for attackers. In the US, authorities have specifically warned about Iranian-affiliated actors targeting internet-connected programmable logic controllers, the industrial technology used to control physical equipment and processes.
Extract — continue reading at the source.
