WASHINGTON – Companies including utilities, banks and phone carriers would have to spend almost nine times more on cybersecurity to prevent a digital Pearl Harbor from plunging millions into darkness, paralyzing the financial system or cutting communications, a Bloomberg Government study found.
Spies, criminals and hacker-activists are stepping up assaults on U.S. government and corporate systems, spurring efforts by Congress and President Obama to shield infrastructure essential to U.S. national and economic security, such as power grids and water-treatment plants.
Hardening those systems would require a significant investment given the increasing stealth and sophistication of hackers, according to Lawrence Ponemon, chairman of the Ponemon Institute, a research firm that collaborated with Bloomberg on the study released last week in Washington.
The consequences of a successful attack against critical infrastructure makes these cost increases look like chump change, Ponemon said in an interview. It would put people into the Dark Ages.
The study, described by Ponemon as the first to place a price tag on cybersecurity, is based on interviews with technology managers from 172 U.S. organizations in six industries and the government. Survey respondents were granted anonymity owing to the sensitivity of discussing cybersecurity weaknesses.
To achieve security capable of stopping 95 percent of attacks – considered by the Traverse City, Mich.-based Ponemon Institute to be the highest attainable level – those surveyed said they would have to boost spending to a group total of $46.6 billion from the current $5.3 billion.
The findings add to debate in Washington over how to compel operators of vital infrastructure to bolster their network defenses. House and Senate lawmakers are considering a series of measures aimed at thwarting hackers, spurred by high-profile assaults at companies including Sony and Citigroup.
Senate Majority Leader Harry Reid, a Nevada Democrat, said in late January he would bring a comprehensive cybersecurity bill to the floor of the chamber for debate by Feb. 17.
The bill would mirror elements of an Obama administration proposal in May that calls for the Homeland Security Department to identify critical infrastructure and set cybersecurity standards for operators of such systems.
Obama cited the need for far-reaching legislation to stay one step ahead of our adversaries in his Jan. 24 State of the Union speech to Congress.
A government report in November named China and Russia as the leading perpetrators of cyber espionage.
In the House, Republicans including Dan Lungren of California are pursuing several narrower bills rather than a single comprehensive measure.
They favor incentives to spur companies to share cyber-threat information and better protect their networks.