I was rather surprised when during a discussion on security one of my students referenced the attack on Morgan Hill (a city just south of San Jose). Not knowing about it, I Googled around a bit and was frankly shocked—not just by the attack, but by how underreported it went. Some party or parties with apparently expert knowledge of AT&T’s infrastructure severed (only!) eight fiber optic cables. The extent of the damage was sobering, if brief. According to Bruce Perens’ report:
“That attack demonstrated a severe fault in American infrastructure: its centralization. The city of Morgan Hill and parts of three counties lost 911 service, cellular mobile telephone communications, land-line telephone, DSL internet and private networks, central station fire and burglar alarms, ATMs, credit card terminals, and monitoring of critical utilities. In addition, resources that should not have failed, like the local hospital’s internal computer network, proved to be dependent on external resources, leaving the hospital with a “paper system” for the day.”
Wouldn’t you think cell phone service would still work if you severed underground fiber? But cell phone service is basically a network, and even towers that use radio frequency transmissions rely on their wired connections to centralized servers. Wouldn’t you think a hospital’s internal network could carry on without a connection to the outside world? But it too was dependent on outside services.
Service was out for about a day for hundreds of thousands of people and businesses. That may not seem terrible until you think about what a day without 911 service would be like. What pulled the city through was the local cadre of ham radio operators. Respect and thanks are owed to these volunteers, and kudos to the local authorities for the foresight to have long standing relationships with the hams.
Why haven’t we heard more about this?
In the modern, consumer-driven, 24-hour news cycle, if it bleeds it leads. Since, strangely, there was no concurrent terrorist attack and no one was hurt, the event was a blip on the news radar screen which quickly vanished. It is left to the imagination how much we would have heard about it had the intent (which remains mysterious) been more malicious.
I can’t realistically fault the mainstream news media for not analyzing in depth a story in which not one person was injured. But I remain surprised at the lack of noise that has reached my ears from respected sources in the information security world. Neither SANS nor NIST have a whisper about the attack or its implications for those of us who work with computers, networks, and information security on their websites. Industry specific blogs, for example related to the internet or homeland security, have reported the event, but the computer industry has been remarkably silent about the important lessons illustrated by this event.
So what are the lessons for computer professionals?
First, the Morgan Hill attack should remind any computer professional of the primacy of physical security. If you can get your hands on it, it’s game over.
Second, I’ve always been a big fan of having low-tech backups for high-tech solutions. How many calls for emergency police and fire services would have gone unanswered if not for the ham radio enthusiasts of Morgan Hill?
Third, the drawbacks of centralization must be mitigated. Bob lives in San Martin. Someone cuts a fiber optic cable in Morgan Hill. Now Bob’s cell phone doesn’t work. It seems ludicrous, but it happened because the local cell phone network was optimized through central switching devices for speed and service, not reliability. We must examine our networks carefully for non-obvious single points of failure, and dependency on remote services.
Remember, if you’re going for CompTIA A+ certification, networking is 15% of the Essentials test and security is 8%. For the CompTIA A+ Practical Application test the percentages are 15% and 13%, respectively. The attack on Morgan Hill provides a vivid and blessedly bloodless (this time) example of the real world importance of these topics.
Perhaps you’re familiar with the How Stuff Works series of books. They cover topics from military hardware to the mundane, explaining how they work in full page, full color graphics. They are like picture books for adults, and they’re great for visual learners. Success brought sequels, some of which focused on topics that would be useful to those gunning for CompTIA A+ certification. How Networks Work is a wonderful resource for those who find textbook descriptions of routers and switches lacking, and I’ve often recommended it for visual learners. Once upon a time, A+ certification courseware even came with a copy of How Computers Work, which was very useful for students curious to see the inner workings of hard drives, RAM and more.
While CompTIA does not directly address phishing in the A+ certification objectives, most A+ certification books I’ve read expressly mention it as it relates to the Security domain of both A+ certification tests. Sometimes end users will ask me, “What exactly is phishing?” or “How can I tell if an email is real or fake?” A simple, direct answer can be elusive, as the tell-tale signs of a phishing email are varied, and users often gain knowledge of them through experience.
I’ve just posted a