There is a continuing culture chasm between cybersecurity managed by the CISO and engineering and operations personnel responsible for OT. Part of the gap stems from many CISOs’ and their teams lack of experience and understanding of control /protection systems and devices and engineering and operations requirements and work processes. Engineering and Operations have a […]
Category: Unfettered
OT/control system cyber security has changed and not for the better
There has been significant progress in securing IT and OT networks. However, one would expect that after 23 years, the “OT” security community would be further along in securing critical infrastructures from control system and other kinetic cyber incidents. Unfortunately, the engineers needed to safely secure control systems are generally not involved while the network […]
Sam Houston State University paper – “Who’s in charge of OT security”
The Institute for Homeland Security at Sam Houston State University published my paper –Whos_in_Charge_of_OT_Security.pdf (ihsonline.org). CISOs have traditionally been responsible for cyber security of enterprise IT networks excluding the control system (operational) assets which were under the purview of the engineering organizations. After the 2006 Gartner Research paper that coined the term “OT”, the CISOs […]
Government and industry are indifferent or unaware of critical infrastructure kinetic cyber incidents
Pagers and walkie-talkies are still used by US critical infrastructures such as power, water, and oil/gas. It appears the compromise of the Hezbollah pagers, walkie-talkies, and solar systems were supply chain attacks, somewhat akin to the Farewell Dosier attack on Gazprom in 1982. The Hezbollah pagers and walkie-talkies needed to be remotely actuated, making them […]
Government and industry organizations’ gaps in understanding control system cybersecurity
Cybersecurity programs assume organizations can recognize control system incidents as being cyber-related. Yet the lack of control system cyber expertise by government organizations including NTSB, FDA, FBI, TSA, EPA, CISA, and DOE have not identified control system incidents as being cyber-related. The five cases discussed were fatal catastrophes. In all cases, NTSB identified control systems […]
Critical infrastructure cyber security incident reporting is not working
Viable cyber security programs require organizations to recognize incidents as being cyber-related. That is generally straightforward for IT and OT network-based cyber incidents. However, the same can’t be said for control system cyber incidents in any sector. People in cybersecurity are comfortable with saying that insider threats (to data and IT systems) can be either […]
CrowdStrike, SolarWinds, and Stuxnet demonstrated the cyber fragility of IT and OT systems
Fifteen years ago, Stuxnet demonstrated that getting to the Engineers’ Workstations can cause devastating damage. Three years ago, SolarWinds showed that malware could be inserted into the update cycle. Two weeks ago, CrowdStrike demonstrated that Engineers’ Workstations are still cyber vulnerable to automatic updates that are fully trusted. It was evident that OT (and IT) […]
Issues with Identifying Control System Cyber Incidents – MORS presentation
July 17, 2024, I gave a presentation to the Military Operations Research Society (MORS) on “Issues with Identifying Control System Cyber Incidents.” Government and industry organizations tend to under-report, and under-share control system cyber incidents. Identifying control system cyber incidents is much less mature than IT and OT network anomaly detection with minimal applicable cyber […]
Identifying control system cyber incidents requires expertise not readily available and government reporting changes
Identifying control system incidents as being cyber-related is difficult. It is complicated when government and industry organizations rush to judgment by stating that incidents weren’t cyberattacks without knowing the actual cause or setting reporting thresholds that exclude many actual control system cyber incidents. Consequently, it is difficult to identify trends when so many real cases […]
Training for identifying control system incidents as being cyber-related
Each time I provide numbers of control system cyber incidents, I get feedback from OT cyber security experts and others “demanding” detailed information. The most recent case was my comment that there have been more than 150 control system cyber incidents in water/wastewater. Because of the lack of industry being able to identify control system […]