Editorial: Oh Security—Where Art Thou?

Abstract

As I write this editorial for Volume 14, Issue 2 of the ACM Transactions on Embedded Computing Systems, I am riled up with the concern that my medical data, together with many personal information might be in the hands of some identity thief—post the security breach of my health insurer Anthem. It seems that tens of millions of customer data might have been stolen by hackers, which could include me and many of my colleagues. This is not the only one on our mind these days. Right before the winter holidays of 2014, a German steel plant was struck by hackers—they manipulated and disrupted the control system of the plant and caused physical damages. Also, who can forget that the breach of SONY Entertainment caused an uproar right before that—and ended up determining the fate of a movie's impending world wide release? These are but a few highly publicized cases. According to the reports I read, most government information systems around the world are targeted hundreds of times a day by hackers—malicious or benign. We have created a digital world – the interconnected world of devices, machines, and systems, and the flip side of all that is the incessant attacks and insecurity. While the Anthem breach leaves us with the possibility of loss of privacy, identity theft, and other malicious use of our personal information by miscreants, the attack on the German steel plant leaves us with the possibility of cyberattacks that could lead to another Bhopal disaster or a Chernobyl, depending on how sophisticated and massive the attack might be on existing chemical or nuclear plants. On top of all these, the extant cybersecurity of all these systems are not only insufficient, they are also often retrofitted without a proper proof of security. While in the past such systems have been isolated from the prying eyes of hackers through air gap and obscurity, it is no longer the case. The IP convergence that provides the comfort of browsing the live data on the state of the plants from the offices and home of engineers also created the Achilles heel of such systems. With the growth of handheld devices and high-speed wireless networking, there is no going back on that—while we stand exposed to possibilities of huge industrial accidents in the hands of hackers who might be even state actors. In this brave new world, we need to make cybersecurity …