UAE needs better protection of critical infrastructure

But changes are being made to better prepare the country against cyber attacks, attendees at the fourth Electronic Warfare GCC conference in Abu Dhabi heard.

ABU DHABI // The protection of the critical national infrastructure involving oil, gas, water and electricity in the UAE is lagging, according to an official at the National Electronic Security Authority (Nesa).

This could cause major disturbances to key services such as the supply of water and electricity, Dr Saud Al Junaibi said at the fourth Electronic Warfare GCC conference in Abu Dhabi on Wednesday.

“Critical infrastructure is a place where most of the attackers try to get into and disturb critical services,” he said during his presentation on cyber warfare. “This is because oil and gas as well as utility sectors provide major and key services to countries like the UAE and these are usually targeted by different threats to disturb services.”

Dr Al Junaibi said that, unlike in other sectors like finance, infrastructure that is built to operate other infrastructure is still behind in terms of protection.

“Data detection systems like Scada (Supervisory Control and Data Acquisition) are still behind in terms of protection from cyber threats, especially the legacy systems,” he said. “They’re used to collecting data from the different sensors in the infrastructure, they’re used to delivering services to end-users so if any attackers manage to get into these systems, they’ll cause big disturbance to key services like electricity and water supply.”

One prominent regional attack was Stuxnet, a computer worm that was able to enter Iran’s nuclear facility in 2010.

“More and more consultants are finding vulnerabilities into the systems,” he said. “And some of these systems are accessible by normal users through the internet and others [get destroyed] due to malware.”

Dr Al Junaibi said the lack of communication between IT and operations systems was a challenge.

“There is no big coordination between them to [communicate] the security of these networks,” he added, saying the authority was soon planning a Technical Standards Forum, which will “constantly evolve its focus between participants to improve their abilities”.

Dr Graziano Lubello-Lincenti, Signal Intelligence product manager at Elettronica S.p.A in Italy, said the military was also vulnerable to such attacks.

“Communication between these systems is based on wireless links that are more sensible to attacks and not so protected,” he said. “This means military networks for communication or command and control, mobile radios, integrated air defence systems, tactical data information link, C2 networks and airborne and terrestrial radio systems.”

A couple of months ago, a US report compiled by Going Global Defence Initiative of the Virginia Economic Development Partnership stated UAE Government websites were vulnerable to cyber attacks that were seeking to exploit defence and security flaws.

But defence experts said progress is being made.

“Even today, there are Government agencies in the UAE that don’t know they can get help from Nesa,” said Matthew Cochran, chairman of Defence Services Marketing Council in Abu Dhabi. Nesa “has a collaborative approach to bringing all standards up to a very high international standard across sectors like oil and gas and government sectors because, by reaching out to them, it will benefit national security in a cyber electronic warfare approach.”

He said the conference helped local companies learn more about the authority’s role.

“Nesa is still two years young and it’s taking a step-by-step approach,” Mr Cochran said. “But today, we have seen them sharing more and more information with the industry which is helping to benefit how we all work together.”