Unfettered Blog

ICS Cyber Security Lecture at West Point

I have been invited to give a lecture on ICS Cyber security at West Point April 8th on control system cyber security. The presentation will address what is control system cyber security, how is it different than IT security, what has actually occurred recently, and examples of what is being...

A “Tale of Two Cities” – where are the insurance companies?

According to an article in BBC, underwriters at Lloyds’ of London say they have seen a "huge increase" in demand for cover from energy firms. But surveyor assessments of the cyber-defenses in place concluded the cyber defenses were inadequate. Now, compare this to the US electric industry.

2014 ICS Cyber Security Conference

The14th ICS Cyber Security Conference (sometimes known as "Weisscon") will be held October 20-23, 2014 at Georgia Tech. Based on record attendance from last year's conference, please consider making your registration early to assure a space. Registration for the conference will be open to the general public soon.

The NIST Framework and what still needs to be done

The recently issued NIST Framework on CIP is a good basic top level document.  It directly addresses ICS which is a great step forward and I am very happy to see IEC (ISA)-62443 liberally addressed. I believe the shortcoming is the lack of any actual requirements.

How serious is the Aurora vulnerability for nuclear plants

The emergency safeguards in existing commercial nuclear plants use large AC motors for their emergency core cooling.  As the Fukushima event demonstrated, emergency core cooling may be needed for a significant period of time. It has been demonstrated that Aurora can damage AC motors.  Since very few substations have implemented the...

Who is kidding whom about the cyber vulnerability of the electric grid?

Paul Rosenzweig wrote a blog on Lawfare (http://www.lawfareblog.com/2014/01/how-likely-is-a-successful-attack-on-the-electric-grid/) on “How Likely Is A Successful Attack On The Electric Grid?” Paul’s question of how likely is a successful attack on the electric grid has an easy, but uncomfortable answer - near 100%.

An ICS Cyber Vulnerability Beyond Stuxnet

A presentation was made at the S4 Conference on wired HART vulnerabilities.  Effectively the vulnerability allows the take over of a single field device, using the single field device to take over all of the other field devices on the HART highway, and/or to take over the asset management software.

Why has Aurora become so political and why is the electric industry fighting it?

Aurora was first publicly demonstrated at the Idaho National Laboratory (INL) in March 2007.  DOD is responsible for assuring continuity of electric power at critical defense facilities. As such, DOD recognized the potential impacts from Aurora and initiated an Aurora hardware mitigation program.

Making progress – one person at a time

I received the following Link-in request and thought it would be of interest as I believe it covers a broad swath of the utility infrastructure.  “We met several years ago, I think back in 2002, when you spoke at a SCADA system users group meeting.

ICS cyber security and plausible deniability

I believe way too many people and organizations particularly in the electric and water industries have a severe case of plausible deniability - “if I have not heard about it to my face, I do not have to address it.” However plausible deniability may have just sprung a leak.