Recent issues and coming events

Because of preparation for the October ICS Conference, I have not had a chance to be as active a blogger as I should. I wanted to use this note to provide a capsule recap of interesting events and upcoming activities:- Two weeks ago, I gave a presentation at the High Tech Criminal Investigation Association in Hershey. One of the attendees mentioned he had several control system compromises but hadn't realized what they were.- Last Friday I was made aware of a cyber compromise of an EKG in a Class 1 trauma center.- The case of the utility being fined for their peaking units not being available demonstrates a gaping hole in the NERC CIP approach. The state PUC ruling could be a precedent that could affect every peaking unit in the country.- Much has been made of responsible disclosure. Thursday I met with a vendor (and utility) who recently disclosed a vulnerability in their SCADA system. The vendor will talk at the October Conference. Hopefully, other vendors will be as forthcoming.

Next week, I will be giving a presentation on ICS cyber security and its impact on national security at Stanford's Center for International Security and Cooperation (CISAC) on Monday and in Montgomery, AL at the Air Force Research Institute on Wednesday. Friday I will be on a panel at the Transportation Research Board reviewing proposals on cyber security for mass transit.

Joe Weiss