How can we secure our systems when we can hardly communicate

Jan. 27, 2009
I had some recent experiences with very knowledgeable people that demonstrate how little we really communicate with each other. Yesterday I had a discussion with an IT security vendor who has a security solution for endpoint devices. This was a very knowledgeable security expert who is working with control system vendors and control system end users as well as the IT community. He felt their endpoint security solution was directly relevant to industrial control systems. When I asked him what he considered an endpoint it was cell phones, PDAs, laptops, etc.
I had some recent experiences with very knowledgeable people that demonstrate how little we really communicate with each other. Yesterday I had a discussion with an IT security vendor who has a security solution for endpoint devices. This was a very knowledgeable security expert who is working with control system vendors and control system end users as well as the IT community. He felt their endpoint security solution was directly relevant to industrial control systems. When I asked him what he considered an endpoint it was cell phones, PDAs, laptops, etc. When I told him what we consider endpoints are for industrial control systems, he was stunned.  I just had a weekly telecom dealing with Smart Grid, specifically Industry-to-Grid (I2G). Industry is defined as power generation and large industrials. When ISA POWID was mentioned, one of the more loquacious participants asked first what was POWID and secondly what was ISA. For a specialized group such as this, how can that be? Lack of communication is not a recent issue. Several months ago, I attended an Infragard meeting in San Francisco on securing the critical infrastructure. At the beginning of the meeting, the FBI mentioned IEDs. To the people attending the meeting representing physical security the term IED meant Improvised Explosive Devices. When I mentioned that we have a different meaning for IEDs- Intelligent Electronic Devices (eg, smart relays, etc), the vast majority of the attendees had never heard that term. The terminology used by the different organizations often has different meanings, even if the words are the same. Several years ago at the first International Standards Coordination Meeting on Cyyber Security of Control Systems I put together a list of common terms such as "control systems", "SCADA", and "security" and showed how different the definitions were for different organizations - ISA, NIST, IEEE, NERC, etc. There are many more examples I could provide to prove the point that we need to make sure we are truly communicating. It seems like I will have to do this again for the October Control Systems Cyber Security Conference. Joe Weiss

Sponsored Recommendations

Measurement instrumentation for improving hydrogen storage and transport

Hydrogen provides a decarbonization opportunity. Learn more about maximizing the potential of hydrogen.

Get Hands-On Training in Emerson's Interactive Plant Environment

Enhance the training experience and increase retention by training hands-on in Emerson's Interactive Plant Environment. Build skills here so you have them where and when it matters...

Learn About: Micro Motion™ 4700 Config I/O Coriolis Transmitter

An Advanced Transmitter that Expands Connectivity

Learn about: Micro Motion G-Series Coriolis Flow and Density Meters

The Micro Motion G-Series is designed to help you access the benefits of Coriolis technology even when available space is limited.