Input to the Commission on Enhancing National Cybersecurity

Industrial Control Systems (ICS) which control our critical infrastructures, including capabilities like bulk power generation, are unusually vulnerable to cyber attacks. The National Research Council (NRC) has reported that such an attack on the bulk power system “could deny large regions of the country access to bulk system power for weeks or even months. An event of this magnitude and duration could lead to turmoil, widespread public fear, and an image of helplessness”. While this is the subject of many ongoing current and proposed future efforts, very few are addressing the core underlying challenge of ICS security: namely, that the ICS is fundamentally insecure and in its present form cannot be made secure. A primary cause of this is that they are built on top of operating systems that cannot be made secure.