Recent control system cyber cases can impact safe facility operation

IP network hacks and ransomware may not be able to be stopped. That includes cyberattacks against control system vendors who offer “cyber secure systems” and cyber security services. Control system vendors provide systems globally including to China, and some also have design and manufacturing facilities in China. The Johnson Controls and Bently-Nevada cases are not […]

CS2AI podcast on control system cyber security

I did a podcast for CS2AI on control system cyber security. The podcast was to educate people that control systems are composed of process sensors, actuators, drives, controllers, HMIs, networks, and network devices because OT cyber security practitioners have limited the discussion to HMIs, OT networks, and OT network devices. The podcast also discussed the […]

The European Union moves to regulate its digital economy by proposing cybersecurity requirements – is the CRA a bridge too far?

“In other words, there is no resilience in this particular material when it is at a temperature of 32 degrees. I believe that has some significance for our problem.” – Professor Richard Feynman commenting during the 1986 Challenger Commission hearings. The Proposal for a REGULATION OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL on horizontal […]

Microsoft Australian East Data Center control system cyber incident – unintentional or malicious?

Data center control system cyber incidents have shut down or damaged data centers operated by many different entities globally. August 30, 2023, a utility voltage sag tripped cooling units at the Microsoft Australia East Azure Data Center. When the voltage sag occurred, all five chillers in operation faulted and didn’t restart because the pumps did […]

Is the U.S. Government’s Cyber Informed Engineering Implementation Guide the long-awaited breakthrough in CIP?

USCG Icebreaker opening path through the ice* This past year has been disappointing for governments and institutions issuing documents on critical infrastructure protection.  The European Union has issued a draft of the Cyber Resilience Act[1] and NIS2 Directive[2].   Across the Atlantic the U.S. has after a series of high-profile cyber incidents on its infrastructure (Colonial […]

Hacking insecure process sensor systems may have affected the Chernobyl nuclear plant site

I am an engineer not a threat analyst. I can tell you what can happen to control systems from cyber vulnerabilities; I cannot tell you why someone would or would not want to exploit these vulnerabilities. My concerns are from a safety perspective as process sensors are used globally to monitor environmental conditions around industrial […]

A Tale of Two Cities water attacks – Oldsmar and Discovery Bay

There have been more than 130 control system cyber incidents in water/wastewater utilities. Like Oldsmar and Discovery Bay, most of these incidents have occurred in small water utilities. Many of these incidents were not publicly disclosed, nor were the utilities required to disclose these incidents. When the Oldsmar water “hack” was publicized, a water system […]

Differences between IT and control system cyber incidents in maritime

Researchers at NHL Stenden University of Applied Sciences in the Netherlands have launched the Maritime Cyber Attack Database (MCAD). MCAD includes information on over 160 cyber incidents in the maritime industry. When compared to my database of control system cyber incidents, the MCAD database was missing the cases where control system cyber-related incidents caused physical […]

Critical infrastructures cannot be secured when process sensors are not secure

If you can’t trust what you measure, there is no cyber security, resiliency, process safety, productivity, or predictive maintenance in any critical infrastructure or cyber-physical system. Process sensors have no cyber security or authentication yet use remote access extensively as documented in the process sensor vendors’ specifications. ISA and NIST have identified there is no cyber […]

Surface transportation is cyber vulnerable and control system issues are not adequately addressed

May 25, 2023, I gave a presentation to the American Public Transportation Association’s (APTA) Enterprise Cybersecurity Working Group (ECSWG) and Control and Communications Security Working Group (CCSWG) teleconference on “Undetected ICS Cyber Incidents”. The general status was the same as for oil/gas, electric, nuclear power, water/wastewater, medical devices, etc. That is, the focus being on […]