ACS 2011 Conference Summary - September 22

The final agenda can be found at www.realtimeacs.com There are several unique hallmarks of the conference:

  • Discussions of actual control system cyber impacts
  • The significant amount of discussion makes keeping a schedule almost impossible
  • Many of the presenters are not recognizable as they are not the typical speakers – these are the control system cyber security experts.

Thursday September 22

High Points:

  • Robert Trainor from NTSB provided as summary of their findings on the San Bruno gas pipeline rupture. It was not a pretty picture detailing PG&E and the California Public Utilities Commission (CPUC) incompetence. Ironically there was no attendance by either.
  • A utility provided a presentation on their approach to securing their assets (real security) and their rationale for having a penetration test performed on one of their RTUs. Mocana described their test results from successfully penetration testing the VxWorks-based RTU.
  • An ex-Secret Service Agent described how law enforcement would address a control system hack. During the open discussion, the FBI confirmed ICSs in the US have been hacked and held for ransom. They also mentioned they currently do not have a vehicle for sharing information with industry.
  • Marty Edwards from DHS stated that if there is a design deficiency and cannot be patched, it is not considered a vulnerability.  Consequently, no disclosure is required.  Recall that Ralph Langner, Marcelo Branquinho, and Jake Brodsky demonstrated inherent ICS “vulnerabilities”.  However, according to Marty these “issues” are not vulnerabilities and need not be disclosed.

What are your comments?

You cannot post comments until you have logged in. Login Here.

Comments

No one has commented on this page yet.

RSS feed for comments on this page | RSS feed for all comments