Analog is the next big thing: Cos are switching back to gears and levers for security

By David Sax
Right before Christmas, two power companies in Ukraine were simultaneously targeted in what's now regarded as the world's first successful cyber attack on a public utility. The hackers (most likely Russians) knocked out electricity to more than 80,000 customers for several hours.

The lesson: In the age of cybercrime, the best insurance may be analog. As we've rushed to connect everything from power plants to home thermostats to the Internet, the risk of a catastrophic cyber attack has multiplied, because the systems people rely on are now more complex, communicative and concentrated.

"You're buying a capability, but at the same time you're buying a vulnerability," says Richard Danzig, a senior fellow at the Johns Hopkins Applied Physics Lab. "A digital attacker can take out all systems with one attack."

That's why Danzig recommends deploying physical backup hardware in the most vulnerable places of the US power grid, military installations, and other key infrastructure.

"My argument is that, if your main system is digital, you're stronger if your safeguard is analog."

What's lost in digitisation is the concept of defense in depth, according to Joe Weiss, a cybersecurity consultant to the power industry."Defense in depth means you have layers of protection," he says.

'But digital, even when it claims to have multiple layers, is in a sense one layer. Penetrate that, and you could potentially no longer have another layer you need to penetrate," he said.

Anything that's networked and controlled by a computer has the potential to be compromised. Web connected pacemakers, insulin pumps, airplane control systems, prison door locks, and even cars are at risk of hacks and hijackings.

CAN'T BE INFECTED BY MALWARE

A particular vulnerability for manufacturing is the PLC, or programmable logic controller. That's the purpose-built industrial computer that sits on just about every important piece of factory equipment, from blast furnaces to automotive assembly robots to lighting and ventilation systems.

PLCs can theoretically be reprogrammed with different instructions. Thus, a growing chorus of experts is calling for he development of new analog logic controllers. The PLC of a piece of equipment wouldn't need to be hooked to a network vulnerable to cyber attack. Its instructions could be changed only by manually inserting a new circuit board, which can be made quickly using a 3D printer.

"Our research, technology, and entire company is built around the fact that we can operationalize human knowledge," says Rohyt Belani, Phish Me's chief executive officer (CEO). "If you rely totally on digitisation, you're in trouble."