ENISA- the European Union Agency for Network and Information Security – issued a report on patching SCADA systems: “Window of exposure … a real problem for SCADA systems? Recommendations for Europe on SCADA patching” dated December 2013.
The October 2013 issue of IEEE Computer magazine has an article titles “Does security trump reliability?” The question of security vs reliability/safety is a critical one for industrial control systems (ICSs). For ICSs, security and reliability are NOT equals - reliability and safety MUST win or the system doesn’t work and...
Ironically, less than a week after the ICS Cyber Security Conference that NERC did not attend, NERC issued another set of Lessons Learned for three incidents. In each case, cyber communication issues resulted in system impacts.
Here are the highlights from Wednesday and Thursday of the 13th ICS Cyber Security Conference. The details are skimpy, because no recording is permitted.
Highlights of the 13th ICS Cyber Security Conference including global attendance, Kaspersky's new Cyber Security Game, report of a major cyber incident in a utility, an ICS Honeypot, and "loss of integrity" incidents.
Much to our surprise, we had to close the registration as there is no more “room at the inn”. The registration is almost entirely from the private industry and international participants as the budget battle in Washington prevented any of the usual government personnel from attending.
This blog is not about people but organizations and the fallacy of not sharing information. I believe there are many people in industry willing to share information about ICS cyber incidents. However, in too many cases, they are not allowed to do so.
The week of October 1st, Project SHINE found an electric substation directly connected to the Internet. Project SHINE analysts were able to see DNP3 ports, Serial Port Server ports, Telnet interface ports, and a web page server. As of the week of October 7th, the substation device was disconnected.
Project SHINE recently found an electric substation directly connected to the Internet. Project SHINE analysts were able to see DNP3 ports, Serial Port Server ports, Telnet interface ports, and a web page server. They discovered this via search engines without even accessing the site itself.
While discussing the recent turbine loss of control issue, I was reminded of a software version issue that I first encountered during Y2K. That is the issue of how long vendors will support older versions of software.