◄Previous: 4.4 What lessons can be learnt?

# 5 Attacking infrastructure

In 2010, a malware known as Stuxnet was discovered. The malware was specifically designed to target programmable logic controllers (PLCs), which are widely used to control industrial motors. It was believed that the malware was designed by the US and Israeli security agencies to sabotage Iran’s uranium enrichment plant, in an effort to stop or delay its nuclear programme.

If malware can target and sabotage an industrial plant, it is possible that other malware could disrupt critical infrastructures such as electricity, gas and water supply systems and communication systems. At the time of writing, no malware has yet caused large-scale infrastructure failure. However, there have been signs to suggest that attempts have been made.

In the following activity, you’ll do a web search to find out whether there is any malware that can attack critical infrastructures or how close it has come to being capable of doing so.

## Activity 13

Allow about 60 minutes

Carry out a web search to look for at least two reports about a theoretical or actual infrastructure attack from the past three years. Summarise the main points of the reports you found.

### Feedback

At the time of writing, some small-scale critical infrastructure cyber-attacks have happened. The most well-known one was the attack on the Ukrainian power network that left hundreds of thousands of people in the west of the country without power for hours. Full details of this and other attacks on critical infrastructure can be found using the link below:

- Top 5 critical infrastructure cyber attacks (Ball, 2017)

As for the UK, the two news reports below relate to critical infrastructure cyber-attacks:

- Russia preparing to mount cyber-attack on Britain’s “critical infrastructure”, GCHQ and FBI warn (Swinford, 2018)

- Major cyber-attack on UK a matter of “when, not if” – security chief (MacAskill, 2018)

◄Contents►Next: Conclusion

OpenLearn - Learning from major cyber security incidents
Except for third party materials and otherwise, this content is made available under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 Licence, full copyright detail can be found in the acknowledgements section. Please see full copyright statement for details.