Critical Infrastructure Systems Seen as Vulnerable to Attack

The vast majority of targeted computer attacks now start with a malicious e-mail sent to a company employee. Now evidence suggests that the same technique could be used to attack watersheds, power grids, oil refineries and nuclear plants. Attackers increasingly use so-called spearphishing attacks, in which they send employees targeted e-mails — often from an e-mail address that matches the name of a colleague, supervisor or chief executive—that contains malicious code. One click is all it takes for an attacker to steal an employee’s administrative passwords, turn their machine into a recording device, and see everything they do.