Zombies Strike Again

Comment | Print | RSS

• Login to Rate

Zombies were front and center in Montana last night when someone hacked into a television station's emergency warning system and broadcast the news of an imminent zombie apocalypse.

The incident is just the latest in a series of false zombie alerts spread through official channels. Several years ago, hackers in Gainesville, Fla., changed the message on a mobile traffic alert sign to warn of attacking zombies.

Zombie Attack Sign

Portable traffic signs have come under attack from zombie-loving hackers.

An article in The Gainesville Sun reassured readers that no attack was in progress, but the fact that official warning mechanisms can be hacked is an issue that government CIOs must deal with. I spoke with Nelson Hill, CIO of the Florida Department of Transportation, who explained that his department takes a multi-dimensional approach to keeping signs and other FDOT assets secure.

"Obviously protecting anything that is public-facing is something we're very careful about," Hill said. He continued, "We take every precaution to make sure they're protected against hacking." The first step the department takes is segmenting the network into three major components.

Hill explained that the network is divided into the "traditional" network, known as MyFlorida.net; the Intelligent Transportation System (ITS), which is the traffic control, monitoring, and notification network; and the network used by the Florida Turnpike system, which handles the financial transactions of the millions of cars passing through toll plazas each month. Hill says that the segmented system carries both benefits and costs for IT executives.

He began explaining, "The larger and more segmented the network, the more difficult it is," but quickly amended his response. "It makes things more difficult from a security policy perspective, but it makes them easier from an operational standpoint," Hill said. As an example, he said, "I don't have to worry about back-door attacks from ITS because [the networks are] segmented," adding that ITS has far more points of access from the Internet due to its function as an alert and information system for the public.

Other segmenting benefits come from the cost side of things. Hill says that the turnpike authority's financial transactions create a special burden. He explained:

Because they deal with credit card data they're under PCI standards. They require those operations to have very, very strict security controls because they handle millions of credit card transactions per month. If we didn't have a firewall between the traditional network and the turnpike then we'd have to put the entire network under PCI standards.

The traditional part of the network is protected by the next security step, the firewalls, and anti-malware software that every CIO demands for the networks under their control. Even so, Hill says that these well-understood threats aren't his most pressing concerns. He said:

It's easier to protect against things like that rather than phishing scams, where a bad guy will send an email that looks like it's from someone you know and has a link. When you click on the link it installs a piece of software that sniffs your data. These advanced persistent threats are much more costly to protect against.

Software development practices and standards sit at the third level of protection for the FDOT networks. "We have coding standards that protect against things like SQL injection. We can help mitigate against cross-site scripting. You can put things in place when you build your website to protect against these attacks," Hill said. The multiple levels and approaches help keep threats at a manageable level for most situations.

Ultimately, though, zombie attacks and hackers must be handled with a common set of criteria and response possibilities. Hill said, "You have to look at the risk and decide what you're willing to accept based on the money you have available to protect against the threats." Where do you put the money for a zombie response in your budget? The hackers would surely love to know.