I was recently informed about a new White Paper by respected cybersecurity authorities Ralph Langner and Perry Pederson of the Brookings Institution called "Bound to Fail: Why Cybersecurity Risk Cannot Be Simply 'Managed' Away" that is now available for free after registration from ControlGlobal at www.controlglobal.com/whitepapers/2013/130304-langner-pederson-cybersecurity-fail.html
This well thought out and timely paper with several references suggests that using Risk Management as the approach to cybersecurity is not necessarily the best approach to addressing this issue. Neither is the recent approach in President Obama’s Executive Order stating “The cyber threat to critical infrastructure continues to grow and represents one of the most serious national security challenges we must confront….” They are effectively abdicating because of tough fiscal times. So rather than do something as simple as pass a set of minimum requirements, we the government will let you do this yourself.
Langner & Pederson suggest that using the Risk Management approach is not enough because it is a business decision tool first and foremost, and depending on the skills of the facilitator frequently only finds the direct risk rather than the ultimate risk that could result. As an example, loss of an HMI screen or station is considered low risk because we have redundant system, however if this same is compromised to appear to be okay and your process runs amok then what? Risk Assessments evaluate the current situation but as we know cyber risks continue to evolve.
Who is responsible for your security? As the expression goes, “look in the mirror.” If you are an End User push on your suppliers to demonstrate they are addressing the cybersecurity National SCADATestbed (NSTb) elicited a bulk of design vulnerabilities in control system products in the products you are purchasing and if you are a Manufacturer, consider this as a investment in a competitive differentiator.
Remember, it is not a question of if you will experience a cyber incident but more a question of when? Will you be ready?
Watch for a feature on this White Paper in the April issue of Control or if you can’t wait download and read it now yourself.
