What are the main challenges in implementing cyber security policies? There are several challenges in developing and most importantly, in implementing cyber security policies. However most successful efforts will be judged according to the way the following 3 important questions are answered: 1. What to protect? 2. From what cyber threats? 3. How, considering that […]
Category: Policy
ICS cybersecurity at the crossroads: heading toward cyber peace or towards a “duty to hack”?
The year is ending and there have been several unsettling events in cyberspace this past year to reflect upon. They all seemed to have come together for me this past week as I completed my speaking engagements in Vilnius and in Garmische-Partenkirchen. The first conference was in Vilnius with the title “Baltic Energy Summit 2017 […]
Is Society Too Trusting?
I wanted to share an interesting observation from this past weekend. Though this does not relate to SCADA/ICS, it does demonstrate just how trusting people are. This past Friday, I had tagged along with my wife as we went to Wal-Mart for our weekly shopping. Following the general shopping, she wanted to go and check […]
IT and ICS cybersecurity: a “Tale of Two Cities”
“It was the best of times it was the worst of times, it was the age of wisdom, it was the age of foolishness” – Charles Dickens, – Tale of Two Cities Never before have I felt so strongly of the existence of separate worlds of understanding between IT and ICS as I have had […]
Good news for ICS protection: ISA providing new ISA/IEC 62443 based industrial cybersecurity training
The great Chinese military strategist Sun Tzu in his book the “Art of War” stated that (to paraphrase) “if you know yourself and the enemy, you will prevail in every battle”. This saying is applicable to the protection of industrial control systems that comprise the technical foundation for today’s critical infrastructure. One of the long-term […]
Not for navigation, information provided may not represent the true position
Many years ago I was fortunate to have two friends who each owned a wooden sailboat. One was a 31-foot Norwegian Knarr made from African mahogany and the other was a 28-foot sloop. To earn a place on the crew I pitched in with all the work in maintaining those boats during the winter. Since […]
The lack of comprehensive investigation and sharing of lessons from industrial control system incidents will continue to leave others as sitting ducks.
This past week news has surfaced about cyber-attacks directed against German industry. In particular about a suspected case of cyber espionage at ThyssenKrupp (1) (2). The announcement that a German steel maker was cyber attacked reminded me about the 2014 German Federal Government IT Department’s (BSI) report of a cyber-attack at an unidentified steel mill […]
In seeking to protect industrial control systems are we clear about what is being threatened and from what threats?
Reading the recently published Industrial Control Systems Emergency Response Team (ICS-CERT) Advanced Analytical Laboratory (AAL) White Paper on Malware Trends left me somewhat unimpressed and disappointed. Whenever I read a document about cybersecurity, especially one written by an institution dealing with the security of industrial control systems, I am keen to see how the authors […]
If control systems move back to analogue can we still keep our smart phones?
I have been following the discussion about the return to analogue. Both this and the Industry 4.0 movement are new to me and have put them on my “study this more” list. Recently a colleague sent me a paper, “The Case for Simplicity in Energy Infrastructure” (1) , which has captured my imagination. It very […]
Meditations on Icelandic tomatoes and the challenge of raising cybersecurity awareness
Raising the awareness for a cybersecurity practitioner about the vulnerabilities of IT and Industrial Control Systems to today’s threats emanating from cyberspace can sometimes resemble the hopeless task of Sisyphus(1). The practitioner has the knowledge but it is not an easy thing to convey the concerns to higher management that may not be as technically […]