ACS 2011 Conference Summary - September 22

The final agenda can be found at There are several unique hallmarks of the conference:

  • Discussions of actual control system cyber impacts
  • The significant amount of discussion makes keeping a schedule almost impossible
  • Many of the presenters are not recognizable as they are not the typical speakers – these are the control system cyber security experts.

Thursday September 22

High Points:

  • Robert Trainor from NTSB provided as summary of their findings on the San Bruno gas pipeline rupture. It was not a pretty picture detailing PG&E and the California Public Utilities Commission (CPUC) incompetence. Ironically there was no attendance by either.
  • A utility provided a presentation on their approach to securing their assets (real security) and their rationale for having a penetration test performed on one of their RTUs. Mocana described their test results from successfully penetration testing the VxWorks-based RTU.
  • An ex-Secret Service Agent described how law enforcement would address a control system hack. During the open discussion, the FBI confirmed ICSs in the US have been hacked and held for ransom. They also mentioned they currently do not have a vehicle for sharing information with industry.
  • Marty Edwards from DHS stated that if there is a design deficiency and cannot be patched, it is not considered a vulnerability.  Consequently, no disclosure is required.  Recall that Ralph Langner, Marcelo Branquinho, and Jake Brodsky demonstrated inherent ICS “vulnerabilities”.  However, according to Marty these “issues” are not vulnerabilities and need not be disclosed.

Join the discussion

We welcome your thoughtful comments. Please comply with our Community rules.
All comments will display your user name.

Want to participate in the discussion?

Register for free

Log in for complete access.


No one has commented on this page yet.

RSS feed for comments on this page | RSS feed for all comments