Viruses or worms haven't killed anyone or destroyed equipment - control system cyber incidents have

The prevailing feeling about why there has been so little focus on securing control systems is that it isn’t real. What I constantly hear is “once there is a real control system cyber incident I will spend the time and money to address the problem”. Unfortunately, there have been already been many very significant control system cyber incidents. However, for various reasons, almost none have been identified as cyber.

I did some detailed analytics on my list of control system cyber incidents based on the NIST definition of a cyber incident – “electronic communication between systems that affect C, I, or A.”  I have been able to identify more than 600 ACTUAL control system cyber incidents (I keep finding more) though most of the incidents were never identified with the word “cyber”. The incidents are both malicious (more than 1/3 were malicious) and unintentional. The incidents have occurred globally in electric grid, power plants, nuclear, water/wastewater, pipelines, oil/gas, chemicals, food, manufacturing, and transportation.

My primary focus was on those incidents that have impacted reliability or safety (almost 2/3 of the incidents) though I have found many cases where viruses and worms were found on control system networks. Most of the viruses and worms consumed internal resources but did not affect system reliability or safety. More than 25 incidents caused injury and/or deaths. More than 50 incidents resulted in equipment and /or environmental damage. A very conservative estimate of the direct costs of control system cyber incidents to date is more than $15Billion. While the recent Lloyd’s of London cyber insurance study on a cyber attack of the power grid provided estimated losses from a hypothetical attack, these are actual costs from real control system cyber incidents.

Control system cyber security is more than security researchers finding another “zero day” vulnerability. What does it take for senior management and decision makers to take control system cyber security as seriously as IT data breaches?

Joe Weiss

 

Show Comments
Hide Comments

Join the discussion

We welcome your thoughtful comments.
All comments will display your user name.

Want to participate in the discussion?

Register for free

Log in for complete access.

Comments

  • <p>Hi, This sounds very interesting. Do you intend to publish results at some point? Jon.</p>

    Reply

  • <p>When in 2005 the malware attack on the PLC's of the control system of Iranian nuclear enhancement facility in Natanz, I patented the solution of using a non-rewriteable plug-in memory in the PLC's of critical facilities, such as nuclear power plants, oil/gas pipelines, and hydroelectric power dams. At one time, Siemens was interested, but then said my solution would not work in process plants. I told Siemens that my solution was designed for relatively steady-state facilities, and perhaps in the future, process plants. </p>

    Reply

RSS feed for comments on this page | RSS feed for all comments