Variations of the Stuxnet computer worm could attack other industrial control systems besides the Siemens systems it was professionally designed to undermine, said a Homeland Security Department official while testifying Nov. 17 during a Senate panel.

The worm, which attacks certain Siemens programmable logic controllers from the associated database after first infecting a Siemens WinCC Human Machine Interface system, was programmed in a modular fashion.

That means, said Sean McGurk, acting director of DHS's National Cybersecurity and Communications Integration Center, that new attackers would reprogram the worm to strike other vendors' industrial control systems. McGurk spoke before the Senate Homeland Security and Governmental Affairs committee.

"To use a very over-used term, it's a game changer," McGurk said. A private sector-wide move toward commercial-off-the-shelf technology in recent years has increased the cyber-vulnerability of supervisory control and data acquisition systems, he added.  

Even so, nobody should expect an immediate wave of cyber attacks against SCADA systems, said Dean Turner, director of Symantec's global intelligence network.

"Stuxnet is of such complexity, requiring significant resources to develop, that only a select few attackers are capable of producing such a threat, he said, "so we don't expect mass of similar sophisticated threats to suddenly appear."

Symantec estimates there have been 44,000 unique Stuxnet infections worldwide as of last week, including 1,600 unique infections within the United States. The worm's appearance serves as a warning that industrial control systems should utilize updated malware protection--but unfortunately, many such systems need to be modernized before they're able to do so, Turner added.

As for how dangerous the threat is, Turner said it's difficult to state with certainty. "We don't know what we don't know."

For more:
- go to the hearing webpage, complete with prepared statements, or watch the webcast

Related Articles:
NSA updating guidance, policies for more secure development
McConnell: Secure Internet requires government role
Majority of Americans support Internet kill switch, says poll