Home

From SANS Bites…

Dec. 12, 2007

The following is from SANS Bites 12.11.2007 with my comments boldfaced : [Editor's Note (Paller): This is a stunning development. NERC's cyber security standards were coming to be seen as almost totally ineffective(That statement is wrong- the industry has been fighting tooth and nail to justify and keep the NERC CIPs as written).FERC's action will immediately shift industry action from NERC's focus on compliance to a new focus on actually improving security and proving the work is done. Kudos to Chairman Langevin and Ranking Member McCaul of the House Homeland Security Subcommittee on Emerging Threats and Cyber Security whose recent hearings illuminate the problems at NERC. Without their leadership, and the active efforts of Mike Peters at FERC, this important action would not have happened until after a major catastrophe. How to navigate the new rules will be a key topic at the SCADA and Control System Security Workshop in January in New Orleans.(First we had the NERC CIP Workshops telling utilities how to circumvent the intent of the industry cyber security standards. This has been followed by multiple conferences on how to be compliant with the NERC CIPs with no thought to actually improving the security of the facilities. Now SANS who knows little about control systems is going to provide help. Where are the utilities going to turn to get useful, factual advice that will actually secure control systems???) Joe Weiss