Have been following the discussions on industrial cybersecurity, convergence, network vs device security, and IT vs OT vs ICS[2]. Some of the points of view differ greatly on what needs to be done. This lack of consensus indicates that something may be wrong with our assumptions and our approach. A disturbing lack progress being […]
Category: Policy
Another view of supply chain risks – third suppliers
Several years ago I was doing a control system cyber risk assessment for a regional transit agency. The most significant safety issue was the Liquified Natural Gas (LNG) transit bus refueling facility. The LNG facility was on the transit agency property and was for use for the LNG-powered transit buses and other LNG-powered agency vehicles. […]
SCIDMARK is UP…!!!
After 5 years of research and hard work, Project SCIDMARK†1 is online. Announced back in October 2015 at the ICS Conference in Atlanta, GA, we feel that the current product is ready for use. As we have several thousand cyber-related events and incidents, the initial christening of the product will have only 11. This is […]
A critical look at the CSIS Report “Dismissing Cyber Catastrophe”
Jim Lewis is a Sr VP at the Center for Strategic and International Studies (CSIS). He wrote the article “Dismissing Cyber Catastrophe” dated August 17, 2020 – https://www.csis.org/analysis/dismissing-cyber-catastrophe?utm_source=CSIS+All&utm_campaign=e4d5b3e04c-EMAIL_CAMPAIGN_2018_11_08_05_05_COPY_01&utm_medium=email&utm_term=0_f326fc46b6-e4d5b3e04c-221758737 . In ‘Dismissing Cyber Catastrophe,’ Jim argues that concerns about industrial cyber security are overblown and the risk is exaggerated. Because the view that ‘cyber catastrophes’ are […]
CISA Alert AA20-205A addressed OT networks but did not address control systems
IT and OT networks are under continuing attacks with varying degrees of impacts. When the DHS CISA Alert was issued specifically identifying control systems, I had two questions: why now and what happened that was unique to control systems? For control system cyber security what is most important are the physical impacts from the control […]
Perhaps we are missing a lesson from Stuxnet?
This summer some of us noted the 10th anniversary of the discovery of Stuxnet. That is when it became known to the public. Since 2010 we have learned that earlier forms of Stuxnet were being developed and tested on the target several years earlier.[1] To commemorate this anniversary several articles and presentations have been published. […]
Perhaps one step backward in building CIP capacity?
“The definition of insanity is doing the same thing over and over again and expecting a different result – Attributed to A. Einstein A recent post titled “Regarding (AA20-049A) Ransomware Impacting Pipeline Operations” on SCADASEC pointed out the FUD promoting aspects of an alert published by The Cybersecurity and Infrastructure Security Agency (CISA) at […]
Targeting Control and Safety Instrumented Systems (SIS): new escalation of cyber threats to critical [energy] infrastructure
“It is no use saying, ‘We are doing our best.’ You have got to succeed in doing what is necessary.” – Winston Churchill Introduction Industrial Control and Safety systems play an important part in insuring that the physical processes taking place in a manufacturing plant, power generation facility or other segment of critical infrastructure do […]
Computer Science programs may fall short in contributing to critical infrastructure protection
“There’s a great future in plastics. Think about it. Will you think about it?” – Advice given to a young man in the 1967 Film, “The Graduate” (1) In the 1967 film, “The Graduate” an older man gives insider advice to a young person struggling to decide on a future career. I was in […]
Attribution: An impossible/inconvenient task or a way to get an APT off one’s back?
“Pay no attention to that man behind the curtain!” – From the film Wizard of Oz, 1939 Recently on the SCADASEC list there have been discussions of reports of cyber attacks on the critical infrastructures of other states with the naming of the state that is responsible. Some say attribution of responsibility is far less […]