Last week at Distributech in Tampa it was interesting to see the dichotomy between many of the HMI suppliers (SCADA) and field device suppliers (PLCs, RTUs, IEDs, smart transmitters and drives, etc.). SCADA and DCS vendors have recognized the need for securing the Windows or Linux-based HMI. However, many field device suppliers (even from the same parent companies that supply both SCADA, DCS, and field devices) have not embraced security to the same degree. Consequently the current state-of-the-art technologies for many field devices include blue tooth, zigbee, backdoors, and inadequate electronic communication logging. Making this point more emphatic, I had a discussion with a major control system vendor who said that security is mainly the end-user's issue. He was assuming that the HMI was secure coming out of the factory and so it was the end-user's responsibility to secure the interconnections of secure devices. Unfortunately, this model doesn't work when the devices to be connected are not themselves secure. This dichotomy ends up affecting the INL/SANS Procurement Specification program as it doesn't address the field devices which are generally not Windows or Linux-based.
Joe Weiss
