Here is where the difference lies…

Symantec released a new whitepaper today via CIO magazine. Here's what the blurb said: "Symantecâ„¢ Endpoint Protection: A unified, proactive approach to endpoint securityOrganizations today face a threat landscape that involves stealthy, targeted, and financially motivated attacks that exploit vulnerabilities in endpoint devices. Many of these sophisticated threats can evade traditional security solutions, leaving organizations vulnerable to data theft and manipulation, disruption of business-critical services, and damage to corporate brand and reputation. To stay ahead of this emerging breed of stealthy and resilient security threats, organizations must advance their endpoint protection. Symantec Endpoint Protection enables organizations to take a more holistic and effective approach to protecting their endpoints..." This sounds just great, doesn't it? Well, I left out the end of the last sentence in the quote on purpose. For Symantec, as for just about every IT security company, and just about every IT security professional, end points are "...endpoints"”laptops, desktops, and servers." But in the world of process automation, whether you are in a refinery, a chemical plant, a water, wastewater or power utility, the endpoints are the field devices and controllers, not the laptops, desktops and servers. And the fact that Symantec doesn't understand this is not only an example of the differences between enterprise IT security and plant IT security, it is potentially downright dangerous. The infrastructure in the process industries isn't going to be protected if CEOs, CFOs and CIOs believe that Symantec knows what it is talking about. Walt Boyes