I was working on the final edits of a project on incident management when I decided for the purpose of improving clarity for the reader to insert a footnote for the term APT or Advanced Persistent Threat. I felt I should not assume that the readers of the document would know what an APT is. […]
Category: General Topic
The need to identify control system incidents as being cyber-related
Control system cyber incidents are different from network cyber incidents because you can’t hide their impact: plane, trains, and ships crash, pipeline rupture, power and water are lost, etc. What is not identified is that many of these incidents have been cyber-related, and this failure to recognize them is because of a lack of appropriate […]
Ford recall on a control system cyber issue
These, and other types of “subtle” control system cyber issues that do not involve Internet Protocol networks demonstrate that identifying control system incidents as being cyber-related often is not obvious. NHTSA recalled 144,500 Ford Mavericks over concerns that the rearview camera display could show frozen images while backing up. November 14, 2024, NHTSA announced that […]
CISA’s new International Strategic Plan: will it improve the security of the world’s C.I.?
Solar power system inverter error code that indicates that the voltage on the grid is too high. The security of power grids even if they have been attacked from cyberspace by hostile actors is not even mentioned in CISA’s plan to protect critical “Physical” infrastructure. (photo by the author) The US Cybersecurity and Infrastructure Security […]
Network security and engineering are still not on the same page, not even the same book
There is a continuing culture chasm between cybersecurity managed by the CISO and engineering and operations personnel responsible for OT. Part of the gap stems from many CISOs’ and their teams lack of experience and understanding of control /protection systems and devices and engineering and operations requirements and work processes. Engineering and Operations have a […]
Speaking at the American Petroleum Institute (API) Cybersecurity Conference
I will be speaking at the 19th Annual API Cybersecurity Conference November 12, 2024. The other speakers in our OT/ICS session are Saltanat Mashirova from Honeywell and Jonathan Boyett from Phillips 66. My presentation will be “Process Sensor Monitoring for Cyber Security, Reliability, and Safety”. Seven years ago, I gave a 4-hour short course on […]
OT/control system cyber security has changed and not for the better
There has been significant progress in securing IT and OT networks. However, one would expect that after 23 years, the “OT” security community would be further along in securing critical infrastructures from control system and other kinetic cyber incidents. Unfortunately, the engineers needed to safely secure control systems are generally not involved while the network […]
Government and industry are indifferent or unaware of critical infrastructure kinetic cyber incidents
Pagers and walkie-talkies are still used by US critical infrastructures such as power, water, and oil/gas. It appears the compromise of the Hezbollah pagers, walkie-talkies, and solar systems were supply chain attacks, somewhat akin to the Farewell Dosier attack on Gazprom in 1982. The Hezbollah pagers and walkie-talkies needed to be remotely actuated, making them […]
Government and industry organizations’ gaps in understanding control system cybersecurity
Cybersecurity programs assume organizations can recognize control system incidents as being cyber-related. Yet the lack of control system cyber expertise by government organizations including NTSB, FDA, FBI, TSA, EPA, CISA, and DOE have not identified control system incidents as being cyber-related. The five cases discussed were fatal catastrophes. In all cases, NTSB identified control systems […]
Critical infrastructure cyber security incident reporting is not working
Viable cyber security programs require organizations to recognize incidents as being cyber-related. That is generally straightforward for IT and OT network-based cyber incidents. However, the same can’t be said for control system cyber incidents in any sector. People in cybersecurity are comfortable with saying that insider threats (to data and IT systems) can be either […]