Internet-based attacks on critical systems rise

Most countries said they expected a cyber attack to disrupt energy supplies within the next two years

Internet-based attacks on critical systems such as gas, power and water have increased around the world, a report suggests.

Security firm McAfee surveyed 200 IT executives working for utility companies in 14 countries.

Eight out of 10 said their networks had been targeted by hackers during the past year.

China was seen as the most likely source of attacks, followed by Russia and the United States.

The number of reported incidents was higher than in 2009 when just over half of those asked said they had fallen victim.

Denial of service

Most of the reported security breaches took the form of distributed denial of service (DDOS) attacks.

These typically involve a network of computers, under the control of criminals, overwhelming a company's internet-connected systems.

While such incidents have the potential to impact websites and corporate networks, researchers said it was unlikely they were intended to cut off energy supplies.

However, there remained a possibility that DDOS attacks could do more harm in future, according to Stewart Baker, a former US national security advisor to President George W Bush and one of the report's authors.

"We asked what what the likelihood was of a major attack that causes significant outage.

"That is one that causes severe loss of services for at least 24 hours, loss of life or personal injury or failure of a company.

"Three quarters thought it would happen within the next two years," he said.

Stuxnet

Arguably the best known example of an internet-borne threat disrupting an industrial system is the Stuxnet worm, which was discovered in 2010.

Analysis suggests that the malicious computer code was specifically designed to take control of machinery in either Iran's Bushehr or Natanz nuclear facilities.

Iran's Natanz uranium enrichment facility is thought to have been one of Stuxnet's intended targets

While it was known that the worm had spread more widely than its intended target, McAfee's research suggested the full extend of its reach.

Among those utility companies that had carried out a search for Stuxnet on their computer systems, 40% found traces of it.

"It probably didn't result in any obvious interference with the systems, because it wasn't designed to do that," said Mr Baker.

"But the fact that it spread so widely and could have done so if it had been differently designed is very, very troubling if you are worried about cyber attacks by hostile nations or extortion attempts by well organised criminal gangs."

Government help

Respondents were also questioned about how much involvement they had with their governments on tackling cyber security issues.

Japan came out on top, along with China and the United Arab Emirates, although the survey did not ask if that cooperation was voluntary or enforced.

The United Kingdom scored lowest of all those taking part in the study.

A Cabinet Office spokesman told the BBC that the situation had improved dramatically since the launch of its National Security Strategy in October 2010.

The policy document recognises cyber attacks as one of the top four national security threats facing the country.

"We have recently launched an initiative with the private sector to help develop greater awareness of the threats and better protection for dealing with them," said the spokesman.