Unfettered Blog

ENISA Report on SCADA patch management - what is missing

ENISA- the European Union Agency for Network and Information Security – issued a report on patching SCADA systems: “Window of exposure … a real problem for SCADA systems? Recommendations for Europe on SCADA patching” dated December 2013.

IEEE Computer article – “Does Security Trump Reliability”

The October 2013 issue of IEEE Computer magazine has an article titles “Does security trump reliability?” The question of security vs reliability/safety is a critical one for industrial control systems (ICSs). For ICSs, security and reliability are NOT equals - reliability and safety MUST win or the system doesn’t work and...

Three blind mice

Ironically, less than a week after the ICS Cyber Security Conference that NERC did not attend, NERC issued another set of Lessons Learned for three incidents. In each case, cyber communication issues resulted in system impacts.

Final Summary-- 13th ICS Cyber Security Conference

Here are the highlights from Wednesday and Thursday of the 13th ICS Cyber Security Conference. The details are skimpy, because no recording is permitted.

Highlights from the 13th ICS Cyber Security Conference #pauto #NERC-CIPS #cyber #security #ICS

Highlights of the 13th ICS Cyber Security Conference including global attendance, Kaspersky's new Cyber Security Game, report of a major cyber incident in a utility, an ICS Honeypot, and "loss of integrity" incidents.

The 13th ICS Cyber Security Conference is sold out

Much to our surprise, we had to close the registration as there is no more “room at the inn”.  The registration is almost entirely from the private industry and international participants as the budget battle in Washington prevented any of the usual government personnel from attending.

The fallacy of not sharing ICS incident information

This blog is not about people but organizations and the fallacy of not sharing information. I believe there are many people in industry willing to share information about ICS cyber incidents. However, in too many cases, they are not allowed to do so.

Utilities are still vulnerable and connected – case history to be presented

The week of October 1st, Project SHINE found an electric substation directly connected to the Internet. Project SHINE analysts were able to see DNP3 ports, Serial Port Server ports, Telnet interface ports, and a web page server. As of the week of October 7th, the substation device was disconnected.

Utility assets continue to be cyber vulnerable and critical information publicly accessible

Project SHINE recently found an electric substation directly connected to the Internet. Project SHINE analysts were able to see DNP3 ports, Serial Port Server ports, Telnet interface ports, and a web page server. They discovered this via search engines without even accessing the site itself.

Vendor patching and older systems

While discussing the recent turbine loss of control issue, I was reminded of a software version issue that I first encountered during Y2K. That is the issue of how long vendors will support older versions of software.