Unfettered Blog

Why the Bridge Still Needs to be Built Between Operations and IT

To many in the IT community, the gap in understanding industrial control system cyber security is gaping. I was drawn to a May 29th Dark Reading article titled “Large Electric Utilities Earn High Security Scores as the title seemed to be at odds with what I have seen.

2014 ICS Cyber Security Conference – Mark Your Calendar

It’s official! The 2014 (the 14th) ICS Cyber Security Conference will be held October 20 – 23, 2014 at the Georgia Tech Hotel and Conference Center in Atlanta. As with previous ICS Cyber Security Conferences, the agenda will not be complete until shortly before the conference to accommodate the most...

Video game on hacking control systems

There will now be the opportunity to turn loose a generation of hackers honing their control system hacking skills on video games. According to the videogame trailer, the game simulates more than 60 different hacks from your cell phone where you can manipulate traffic signals, cause blackouts, etc.  

The electric industry still doesn’t understand what sophisticated attackers are after

Stuxnet and Aurora are not traditional network vulnerabilities and cannot be found or mitigated by using traditional IT security techniques. The Smart Grid NISTR-7628 and NERC do not identify design features that can be exploited. There is a disconnect between what the electric industry is trying to protect and what...

Keynote presentation at Stanford University cyber security workshop

I will be delivering the keynote at the May 31, 2014 ECSaR 2014 Workshop on Engineering Cyber Security and Resilience at Stanford University. The agenda can be found at www.ECSaR-2014-Program.docx. Details on the overall conference can be found at http://www.scienceengineering.org/ase/conference/2014/cybersecurity/sanjose/website/138-2/.

DOE Cyber Security Procurement Language – Is It Comprehensive Enough

DOE recently issued their revised report on Cyber security procurement Language for Energy Delivery Systems dated April 2014. The report is an update on the 2009 INL report. The report does a good job of addressing communication networks and traditional IT issues.

The ICS Cyber Security Conference Is Back On

SecurityWeek acquires ICS Cybersecurity Conference series

A wake-up call to ignoring cyber threats – PG&E indicted on criminal charges

April 1st, a federal grand jury indicted PG&E on 12 counts of knowingly and willfully violating the federal Pipeline Safety Act leading to the San Bruno pipeline rupture. As San Bruno was a control system cyber incident, the cyber security implications include the following.

Speaking at Palo Alto Networks Ignite Conference

I will be speaking April 1st at the Palo Alto Networks Ignite Conference on “Addressing the Most Pervasive Challenges in ICS Cyber Security”.

ICS Cyber Security – where is the American Society of Mechanical Engineers (ASME)

The March 2014 issue of ASME’s Mechanical Engineering magazine had an article entitled "The Internet of Very Big Things". The article focused on the productivity and safety benefits of connectivity, including to the Internet. The discussion on security was either not correct or misleading.  This is not the first time...