Senator grills DOE official over lack of cyber training programs

A shortage in qualified industrial control system, or ICS, cybersecurity professionals — individuals trained to defend the nation’s energy infrastructure from hackers — should cause the Department of Energy serious concern.

An undeniable shortage in qualified industrial control system cybersecurity professionals — individuals trained to defend the nation’s energy infrastructure from hackers — should cause the Department of Energy serious concern, Sen. Bill Cassidy, R-La., told Assistant Energy Secretary Patricia Hoffman during a Senate Energy and Natural Resources subcommittee hearing.

“The number of ICS professionals is severely limited, maybe 500 to 1000 worldwide, and we need tens of thousands. And that begs the question: what are we doing to address the shortage, which is exponential. What are we doing to address this critical shortfall,” Cassidy — referencing a conversation with personnel from the non-profit, Louisiana-based research institute, the Cyber Innovation Center — said.

Reg Harnish, the CEO of New York-based cybersecurity consultancy GreyCastle Security, wrote in an email ‘finding cybersecurity experts is difficult no matter what industry you’re in, partly because it is an ultra-competitive market and partly because there are so few of them. [But] for those entities trying to defend industrial control systems it is even more difficult.’

Arkansas Electric Cooperative Corporation CEO Duane Highley, who also testified to the committee on Tuesday, responded to Cassidy by admitting the U.S. is experiencing a deficit.

“Certainly, the demand for these technically skilled folk causes us a lot of the time to go outside the country to get those people … We just don’t produce enough in house to make it happen,” said Highley.

“I think it’s something to watch but we don’t believe it is insurmountable,” he concluded.

Hoffman countered Cassidy, explaining that the DOE is already working with both University of Arkansas and University of Illinois to develop engineering curriculums that combine energy infrastructure engineering and cybersecurity studies, so that the next class of security specialists can assist the energy sector.

She also pointed to several threat intelligence information sharing partnerships between private sector competitors and the federal government, which are concurrently used to prepare existing, in-house security teams to stop hackers from disrupting, for example, the electrical grid.

“It seems as though you’re not doing that much on manpower or womenpower training though,” Cassidy said to Hoffman, “And I say that because even if you have two universities with engineering programs — and even if they are big engineering programs — it is still relatively small.”

He added, “if I am being told we have between 500 to 1000 people and we need tens of thousands, it seems like … just, doesn’t anyone else see a problem of manpower here?”

A recent Kaspersky Lab’s report highlights the immature state of security surrounding ICS — with nearly 60,000 systems in the U.S. accessible online through Shodan, a custom, online search engine that catalogs internet-connected systems. A total of 189 security vulnerabilities were reported by ICS product vendors in 2015, according to the report, which is up slightly from one year prior. And available exploits were found for more than 20 of the reported software bugs.

In an email, a department spokesperson responded to Cassidy’s criticism: the ‘DOE, in partnership with the Department of Homeland Security, and the energy sector, supports university collaborations that engage 16 universities [in total] with the primary focus on research and development.’

‘Both undergraduate and graduate students participate in research to develop innovative cybersecurity technologies that will transition to the energy sector to reduce the risk of energy disruption resulting from a cyber incident,’ the spokesperson said.

Other known cybersecurity programs created by the DOE include a public depository for basic cybersecurity information and educational resources called the Cybersecurity Awareness & Training Warehouse and Cybersecurity Awareness & Training program designed to train department employees.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Election official says Tina Peters would be consultant, won’t have access to election systems