Continued lack of awareness of ICS-unique cyber security issues

Dec. 13, 2010

There were several opportunities this past week that demonstrated unique ICS cyber security issues are still not well-understood. As I flew to Europe for a Smart Grid Cyber Security Conference, my seatmate was a senior executive with a major management consulting firm doing extensive work in the energy industry. He was fully aware of IT security issues. However, when I described the unique issues associated with ICSs and that the Internet was not the primary threat to ICS cyber security, it was new to him.

There were several opportunities this past week that demonstrated unique ICS cyber security issues are still not well-understood. As I flew to Europe for a Smart Grid Cyber Security Conference, my seatmate was a senior executive with a major management consulting firm doing extensive work in the energy industry. He was fully aware of IT security issues. However, when I described the unique issues associated with ICSs and that the Internet was not the primary threat to ICS cyber security, it was new to him. On Friday, I had a conference call with senior executives from a major research organization interested in expanding their cyber security portfolio. They also fully understood IT security but had little appreciation of the differences between IT and ICS security.

As mentioned, I was a presenter at a European Smart Grid Cyber Security Conference (http://www.samentegencybercrime.nl/Nieuws_over_cybercrime/Smart_Grid_Seminar/Program?p=content). As often happens, I was the only presenter from the ICS community. The focus of the Conference was on smart meter security and privacy issues. In the ICS community, these concerns are secondary to reliability and safety. Yet, these two key criteria were missing. One of the other speakers discussed standards. It was fascinating to see the Conference attendee reactions when the limitations of the NERC CIPs were explained. This included the speaker from Enernex mentioning there were utilities with ZERO NERC CIP critical assets.

The last point of interest at both the Conference and a follow-up industry meeting were the discussions on actual ICS cyber incidents. In both meetings after describing example ICS cyber incidents to date, attendees mentioned similar incidents they had experienced but not publicly disclosed. This is very similar to what frequently happens at meetings or conferences when I describe actual incidents. This gives more impetus for the need for an effective ICS CERT.

One would think there would be more understanding and better information sharing by now.

Joe Weiss

Sponsored Recommendations

Make Effortless HMI and PLC Modifications from Anywhere

The tiny EZminiWiFi is a godsend for the plant maintenance engineers who need to make a minor modification to the HMI program or, for that matter, the PLC program. It's very easy...

The Benefits of Using American-Made Automation Products

Discover the benefits of American-made automation products, including stable pricing, faster delivery, and innovative features tailored to real-world applications. With superior...

50 Years of Automation Innovation and What to Expect Next

Over the past 50 years, the automation technology landscape has changed dramatically, but many of the underlying industry needs remain unchanged. To learn more about what’s changed...

Manufacturing Marvels Highlights Why EZAutomation Is a Force to Be Reckoned With

Watch EZAutomation's recent feature on the popular FOX Network series "Manufacturing Marvels" and discover what makes them a force to be reckoned with in industrial automation...