Beyond Risk Assessment

Understanding Industrial Security Before computer security was a thing, there was Industrial Security. It was primarily physical: Guards, Gates, Guns. The guards would periodically patrol the fence to ensure that there were no holes or evidence of tampering. They had guns to ward off direct attacks and to enforce policy within the plant. They would […]

Budget of ICS Security: Where is the ROI?

How Much to Budget? Many are flummoxed when working on budgets such as ICS Security. Security contains many aspects that are actually routine activities that we should be doing anyway, that actually do have an ROI. If a few minor improvements are made, it can be integrated in to security. Inventory For example, go to […]

Risk Assessments Are Not

The problem with discussing risk on a SCADA/ICS network, especially the way that most security guidelines describe it, is that it isn’t a linear function. In other words, the risk of A happening, B happening, and C happening is not A times B times C. That might be true with safety, but it is definitely […]

In addressing cyber threats to critical infrastructure, it is helpful to think of the lesson of the “3 Little Pigs”

On June 7th the European People’s Party organized a public hearing on Cybercrime and Cybersecurity at the European Parliament in Brussels, Belgium (1) . It was a great honor to be invited as a speaker on Cybersecurity and Critical Energy Infrastructure for the second panel discussion covering the theme of “Cybersecurity: improving European industry”. I […]

OT Security Detects a Problem: Now What?

Let’s fast forward in to the near future. The network configuration is well documented. The hashes of all code are known and recorded. Firewalls have been installed in appropriate places. The network traffic rates and patterns are known and monitored.  Physical LAN port statuses are monitored. In other words the control systems integrity is monitored […]

Succession Planning

After 31 years at the Washington Suburban Sanitary Commission (WSSC) I’m eligible to retire. I will be starting a new position at Jacobs Engineering next month. My kids are looking at colleges and frankly, I need the money. I would happily stay with WSSC if I could afford to, but I can’t. In case you […]

Fun with Fiber Optics

I was swapping out a router today. Our old ones have served us long and well, but the vendor is no longer supporting them as they used to. We also had some creatures that I wanted to get rid of. On the wall in the telecommunications shelter there were three cheap 100Base-FX to 100BaseT converters, […]

I/O commissioning and testing

I rant a lot about I/O testing and design. This is a discussion (and more ranting) of some of the tests and practices we do following construction and later during the maintenance cycle to ensure that the controls, and alarms will work as expected. Before I begin, one might wonder if embedded controllers or RTUs […]