The RSA Cybersecurity Conference in San Francisco is billed as the largest cybersecurity conference in the world with something like 40,000 attendees. I have been attending the RSA Cybersecurity Conference since the early 2000’s and have spoken there a few times. RSA is a five-day conference with the IT cybersecurity rock stars presenting.
I only attended for two days. My observations are unscientific. Given that preamble, on the surface, things are getting better as most everyone I talked to had heard of OT, though most only knew the title, not what it really meant. Those that knew what OT stood for felt it was just about the OT networks. Very few people had heard of control system cybersecurity, and even some of the OT vendors were not aware of the lack of cybersecurity in the process sensors that are inputs to their network monitoring.
No one I talked to was aware of the real scope of the problem or was aware that have been millions of control system cyber incidents. This was evident in that the control system cybersecurity rock stars were not speaking. This year, critical infrastructure cybersecurity took a prominent position with the issuance of NSM 22. NSM22 states: “it is diverse and complex, and includes distributed networks, varied organizational structures, operating models, interdependent systems, and governance constructs.” There was no mention of hardware.
Yet the critical infrastructure is dependent on hardware – pumps, motors, valves, relays, transformers, turbines, robots, etc. As a result, there were no discussions of hardware control system cyber issues such as hardware backdoors in Chinese electric power transformers, port cranes, inverters and circuit breakers; possible control logic compromises with the Iranian Unitronics’ PLC attacks; Russian cyberattacks against U.S. critical infrastructures; the Aurora vulnerability which manipulates physics not data; data center shutdowns from process sensors and chiller motor issues; and medical device control system cyber incidents that have injured hundreds.
Maybe next year RSA will have more of a focus on critical infrastructure cybersecurity.
