June ICS/SCADA Cybersecurity Symposium to address unique control system cyber security issues
June 3-4, I will be participating in the ICS/SCADA Cybersecurity Symposium in Chicago. My two sessions will address important issues unique to control systems not being addressed elsewhere. This includes a recent control system hack of a food processor that could have poisoned the food supply chain. RSA also didn’t address many control system cyber threats.
June 3, I will be moderating a first-of-a-kind session bringing together a control system engineer and an OT network cybersecurity researcher to explore the cultural and operational divide between network security considerations and engineering considerations. The impetus for this session was two-fold:
- The first were recent job solicitations from a medium-size water utility seeking engineers (no mention of cybersecurity knowledge) and a large electric utility seeking an OT Cybersecurity Senior Analyst (no mention of engineering knowledge).
- The second impetus was reflected at the RSA Cybersecurity Conference. Vulnerability researchers (IT and OT) focused on identifying network security vulnerabilities and their network severity without considering the possible impacts on control system field devices or physical processes such as affecting boiler operation, damaging motors or changing voltages. On the other hand, engineers view cybersecurity as only affecting networks and don’t feel it affects them.
The panelists will examine how the differing priorities and mindsets contribute to a persistent “culture chasm” and discuss innovative strategies for bridging these gaps. This gap in mutual understanding between the engineering and networking organizations has prevented critical plant processes and control system equipment from being cybersecure and safe.
Get your subscription to Control's tri-weekly newsletter.
June 4, I will be participating in a session on cyberattacks. As can be seen from the previous session, OT cybersecurity discussions often focus on OT network cyber vulnerabilities, not cyberattacks. Publicly known cyberattacks are generally network cyberattacks such as ransomware or other network malware attacks.
The food processor control system hack that could have poisoned the food supply chain is an example of the apparent lack of interest in cyberattacks that are not related to IT or OT networks. This discussion will address “physics-based” cyberattacks.
Examples include Aurora, which exploits a gap in protection of the electric grid without using any malware; the Stuxnet attack that compromised process sensor data, which was not detected; and spoofed process sensor data that can compromise the operation of Chinese-made large electric transformers installed in the U.S. electric grid. Unlike network cyberattacks, physics-based cyberattacks would appear to be equipment malfunctions leaving little to no cyber forensic trails.
