Cybersecurity needs a community approach

Benjamin Beberness, the chief information officer for the Snohomish County PUD speaks
with Col. Gent Welsh & Major General Bret D. Daugherty.

Cybersecurity needs a community approach

What if a hacker knocked out the state’s power grid? What if terrorists seized control of area dams? And what if residential water systems were all shut off?

More than 100 stakeholders across the public and private sectors came together on April 7 for a cybersecurity seminar and tabletop exercise to discuss just those kind of scenarios.

“When they ask what keeps you up at night, it’s this issue,” said Bill Kehoe, Director of IT for King County. “We do a lot of earthquakes and natural disasters, but we need to have more cyber security tabletops.”

Major General Bret D. Daugherty says this week’s exercise is just the first of many more to come.

“Today’s exercise is to help us prepare for a large and significant cyber attack,” said Daugherty, The Adjutant General for the state of Washington. “We’ll also conduct a quarterly exercise to prepare for floods, fires, earthquakes, etc, but we are now preparing a cyber thread in each one of those exercises. A smart attacker, we figure, will probably hit us when we’re down. And we’re going to train for that and be prepared.”

Globally, seminar attendees were told there’s a shortage of 1 million people to deal with cyber security, the people needed to protect critical networks. Last year, the average attacker on a network was able to go 243 days before being discovered. But hacking attacks are being caught faster than just two years ago, when the average attacker went unnoticed for more than 400 days. Attacks could cost up to $3 trillion loss of productivity.

Gov. Inslee gives five points on building cybersecurity resiliency.

Gov. Jay Inslee gave the closing remarks at the end of the three-hour workshop, stressing that hacker attacks are more than just computer viruses and leaked emails, but could truly harm infrastructure and grind the state’s economy to a halt.

 “We have prepared for earthquakes and fires and floods and what mother nature has thrown at us and we don’t need a 9.0 on the Richter scale hacking event on cyber security and I know some of the best minds in the country are out there working on it,” Inslee said. “We have always been a technologically advanced region and economy and I’m glad we have used that skillset and we know how significant it is. It’s not going too far to say the entire economy depends on our success.”

Inslee addressed officials from Boeing, Microsoft, T-Mobile as well as officials from public stakeholders, including the FBI, Washington State Patrol, Yakima County, King County, the cities of Seattle, Tacoma, Spokane and many others.

“The electricity that comes out of our outlets depends on cyber security,” Inslee said. “The system that keeps the planes and trains depends on our success in this mission statement and we know that cyber threats are no longer limited to viruses or bank hacks or leaks of private emails. It’s become an all-encompassing threat that has the ability to shut down our hospitals, and prevent the delivery of absolutely critical goods and services. This is a matter of public safety, not just embarrassment or inconvenience. It requires a total community effort to stay ahead of those, who want to do us harm. It’s exercises and discussions like we’re having to be up-to-date and unearth as many weaknesses as we can find.”

Spokane Mayor David Condon, center, speaks during the tabletop exercise. He's flanked by Brigadier
General John S. Tuohy, the Assistant Adjutant General of the Washington Air National Guard and
Brig. Gen (Ret.) Gregory Touhill, deputy assistant secretary for cybersecurity for the U.S. Dept. of
Homeland Security.

Spokane Mayor David Condon says cybersecurity isn’t an issue that stops at the Cascade Mountains. He points to Boundary Dam on the Pend Oreille River “is squarely in eastern Washington but it affects power across Washington state. And although we always the Cascade divide, in a scenario like this, there is no cascade divide and we’re more interconnected than not.”

“You will be hacked at some point,” warned Brig. Gen (Ret.) Gregory Touhill, deputy assistant secretary for cybersecurity for the U.S. Department of Homeland Security. “You will be punctured. You have to plan for that. You have to understand the risks. At the end of the day, you won’t have enough money and resources to be able to guard everything. …

“We are all in this together,” he added. “It’s not just the cyber hazard, it’s the physical infrastructure. We all have to have our eye on the ball.”

"What worries me is what we don't know," State Auditor Troy Kelley told attendees. "As a risk manager, someone who evaluates what will happen, we don't know all of the infrastructure that is vulnerable. We don't know what will happen to the banking system or the issues involved there."

Auditor Troy Kelley talks about the risks involves from a cyber threat.

Major Gen. Daugherty notes that the Washington National Guard has been preparing to deal with attackers for years now and has successful units, whose sole job is to test networks and work with public agencies to see where the risks are located for networks.

Benjamin Beberness, the chief information officer for the Snohomish County PUD, notes that testing network vulnerabilities is essential, even for utilities like his, which serves just 330,000 customers.

Beberness compares the situation to that of the hijackers of the planes on Sept. 11, which utilized a small airport in Florida to test their capabilities first. He wonders if a hacker wouldn’t try their luck on the Snohomish County PUD before branching out to a larger power grid attack.

“We all have similar systems,” Beberness said. “ If we’re not secure, what’s to prevent a hacker or terrorist trying to get into our network and do something broader. We take cyber security very seriously.”

In the end, Washington Emergency Management Director Robert Ezelle says that the impacts on people have to be looked at, not just on infrastructure.

“How do we coordinate and pull together the experts in the sector that would essentially be dealing with the technical side?” Ezelle said. “How do we get the information on the people impacted? … I’m going to be very very concerned about the most vulnerable in our society to reach out to make sure they’re being taken care of.”

“We have always been a technologically advanced region and economy and I’m glad we have used that skillset and we know how significant it is,” Inslee added. “It’s not going too far to say the entire economy depends on our success.”



Washington Emergency Management Director Robert Ezelle talks, flanked by deputy director Peter Antolin.