IP network hacks and ransomware may not be able to be stopped. That includes cyberattacks against control system vendors who offer “cyber secure systems” and cyber security services. Control system vendors provide systems globally including to China, and some also have design and manufacturing facilities in China. The Johnson Controls and Bently-Nevada cases are not […]
Category: General Topic
CS2AI podcast on control system cyber security
I did a podcast for CS2AI on control system cyber security. The podcast was to educate people that control systems are composed of process sensors, actuators, drives, controllers, HMIs, networks, and network devices because OT cyber security practitioners have limited the discussion to HMIs, OT networks, and OT network devices. The podcast also discussed the […]
Is the U.S. Government’s Cyber Informed Engineering Implementation Guide the long-awaited breakthrough in CIP?
USCG Icebreaker opening path through the ice* This past year has been disappointing for governments and institutions issuing documents on critical infrastructure protection. The European Union has issued a draft of the Cyber Resilience Act[1] and NIS2 Directive[2]. Across the Atlantic the U.S. has after a series of high-profile cyber incidents on its infrastructure (Colonial […]
Having a framework for a boat does not guarantee that it will float or sail well.
The above is a drawing of the framework of the 17th Century Swedish warship “Vasa”. The design of the bottom was too shallow and caused the ship to tip over when it tried to sail out of port. Lately governments have been issuing cybersecurity policy documents that are shallow in their depth of understanding of […]
Improving Control Systems Management
Operational Technology Cybersecurity is a symptom of a much larger problem. It is a problem that extends beyond just securing networks, keeping forensic logs, managing software and embedded systems. It is MUCH deeper than that. It goes to the core of industrial systems and the people that manage and operate it. HOW DID WE GET […]
A Tale of Two Cities water attacks – Oldsmar and Discovery Bay
There have been more than 130 control system cyber incidents in water/wastewater utilities. Like Oldsmar and Discovery Bay, most of these incidents have occurred in small water utilities. Many of these incidents were not publicly disclosed, nor were the utilities required to disclose these incidents. When the Oldsmar water “hack” was publicized, a water system […]
Differences between IT and control system cyber incidents in maritime
Researchers at NHL Stenden University of Applied Sciences in the Netherlands have launched the Maritime Cyber Attack Database (MCAD). MCAD includes information on over 160 cyber incidents in the maritime industry. When compared to my database of control system cyber incidents, the MCAD database was missing the cases where control system cyber-related incidents caused physical […]
“Chattinn Cyber” with Marsh’s Marc Schein on critical infrastructure cyber security
Marc Schein is the Northeast Cyber Champion for Marsh & McLennan (insurance). Marc has spoken before members of Congress and leaders in the Aviation Industry on Capitol Hill regarding the issues and costs of cyber breaches, and how to properly transfer risk to ensure that an organization or business is properly protected from what might […]
How can you do incident response if you can’t recognize an incident?
Cyber incident response starts with the assumption that you can recognize a control system cyber-related event as being a cyber event. Globally, there have been more than 17 million control system cyber incidents that have killed more than 34,000 yet most of the incidents were not identified as being cyber-related. There is no training for […]