Federal officials who oversee cybersecurity on Wednesday listed four cyberthreats that keep them up at night in an appearance before a congressional panel on Wednesday.
The question was posed by Rep. Jackie Speier, D-Calif., for Admiral Mike Rogers, commander of U.S. Cyber Command and head of the National Security Agency, and Deputy Secretary of Defense Robert Work.
Rogers: “There are three things in cyber that concern me. Are we going to see offensive activity taken against U.S. critical infrastructure? Are we going to see the focus shift from the theft of intellectual property, the theft of information, to manipulation of the data that’s in our system, so we no longer can trust what we see? And the third thing that worries me is, are we going to see non-state actors, read terrorist groups, start to use the web as an offensive weapon.”
Work: “[W]e have a large number of systems that were built in an era … the systems were not built to withstand the cyber environment that we’re in now. So what keeps me up at night is can we get through all of our systems and make sure that they do have cyber hardening. Going forward, we’re making sure that there are key performance parameters in every system we have, but we have to go through this risk mitigation on every one of our systems, and say, what is the critical cyber vulnerability, have we taken care of it?”
Work also echoed Rogers’ statement that the manipulation of data “really keeps me up at night.”
Critical agencies across the federal government have been hacked by China and Russia, including the White House, the State Department, the Department of Defense and the Office of Personnel Management. To date, the hacks have resulted in the theft or exfiltration of information. Officials have worried those hacks could eventually evolve such that perpetrators begin to manipulate information instead of stealing it, and that government data, some of it classified, will become untrustworthy.
Malicious attacks, which are more likely to come from non-state actors such as terrorist groups, would be more likely to target critical infrastructure such as nuclear power plants, transit systems or consumable water supplies.
