The network controlling the country's largest public electric company could be taken down by cyber-hackers because it fails to take basic best-practice security measures, a federal report says.

Despite federal guidelines for securing such networks, the Tennessee Valley Authority power company does not comply with security practices recommended in a report by the U.S. Government Accountability Office.

"Until the TVA fully implements these security program activities, it risks disruption of its operations as the result of a cyber incident, which could impact its customers," the GAO says. TVA delivers electricity to an area that includes most of Tennessee and parts of Alabama, Georgia, Kentucky, Mississippi, North Carolina and Virginia -- an area with a population of 8.7 million people.

The TVA ineffectively separates its control network from its corporate data network, which includes a dangerous blend of badly patched equipment, inadequate security settings and limited intrusion detection, according to a report by the GOA.

Shortcomings of its supervisory control and data acquisition (SCADA) network itself included misconfigured or inactivated firewalls, ineffective passwords, inconsistent configuration management and lack of virus protection, according to the report, "TVA Needs to Address Weaknesses in Control Systems and Networks".

TVA has no comprehensive inventory of its SCADA network and has not ranked network elements according to risk, "thereby limiting assurance that these systems were adequately protected," the report says.

Overall, the authority needs to complete security plans, prioritize its patch management, test its SCADA network for security and execute security training, the report says.

"As a result, systems that operate TVA's critical infrastructures are at increased risk of unauthorized modification or disruption by both internal and external threats," the report says.

"This is not a TVA-specific problem," says Ira Winkler, CEO of Internet Security Advisors Group. "This is a pervasive threat to the whole power industry."

During a talk at RSA Conference earlier this year, he said the blending of SCADA and corporate data networks and their connection to the Internet has boosted the risk of hacking. He detailed how he hacked into a utility's network -- not the TVA -- and took over individual machines.

Whitepapers

• The Trend from UNIX to Linux in SAP(r) Data Centers
• Getting in Compliance With Government Data Regulations By Leveraging Online Security Technology
• How to Offer the Strongest SSL Encryption
• Maximizing Site Visitor Trust Using Extended Validation SSL
• Seven Steps to Reducing your Security Risk
• The Latest Advancements in SSL Technology

View more SECURITY whitepapers

Webcasts

• The Secure Web Gateway. Mission Critical For Business - Webcast
• Mobile Data Security
• Best Practices for Deploying WAN Optimization for Disaster Recovery
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• The self-managed network

View more SECURITY special reports