Many data centers that support the cloud as well as commercial buildings have not adequately addressed control system cyber security. The lack of adequately addressing building control system cyber security was demonstrated to have caused very significant financial and potentially safety impacts. When you consider these control system cyber threats can affect multiple buildings, the […]
A Reality Check of the DOE 100-Day Plan to Address Cybersecurity Risks to the US Electric System
I am happy to see ICS cyber security specifically being addressed by the US Secretary of Energy. It is “unobtainium” to secure the electric system, or any other industry which uses the same equipment, within 100 days even though there can be a good start. Network cyber threat prevention and situational awareness can be employed […]
Enough About Data Breaches. Let’s Talk About OT Security – TAG Cyber
Tag Cyber moderated a roundtable discussion with Mark Weatherford and me on control system cybersecurity. The discussion was why operational technology (OT) is woefully neglected—and what can be done to change that. This discussion becomes even more timely with the recent DOE 100-Day Plan to Address Cybersecurity Risks to the US Electric System. The roundtable […]
Was the Ever Given hacked in the Suez Canal?
This blog is speculative as there is little public information about what caused the Ever Given to run aground in the Suez Canal. I find it curious that a newer ship could have had the technical problems (which could have been caused by a cyberattack) at just the time the ship could entirely block the […]
Can We Trust Control Systems Networks?
Deputy National Security Advisor for Cyber and Emerging Technology, Anne Neuberger, was quoted by Adam Mazmanian in FCW on April 8, 2021 saying “We picked control systems because those are the systems that control water systems, power systems, chemical systems, across the U.S. And we’re seeking to have visibility on those networks to detect anomalous […]
Security Encabulation
For a number of years, work has been proceeding to perfect to the crudely conceived idea of a security augmentation system that would not only supply reverse DNS lookup for use in gratuitous ARP regeneration, but would also be capable of automatic stochastant intelligence. Such a computationless process is the security encabulator. Now basically the […]
Data center cybersecurity – don’t overlook the cyber vulnerable building control systems
According to many people, data is the new oil. Industries such as insurance, finance, retail, etc. depend on massive amounts of data from multiple data centers. However, what happens if you can’t get to your data because the data center infrastructure or servers have been damaged and are unusable? Data is merely a series of […]
Lack of security at Level 0/1: problem of awareness or unwillingness to change priorities?
To be honest I was planning to write about unintentional cyber incidents in critical infrastructure and the need to pull away some of our attention from the sexy topic of cyber-attacks and cyber kill-chains. I changed my mind when I read Dale Peterson’s informative article on “Awareness Of Purdue Level 0 and 1 (In)Security” and […]
The US food supply is neither cybersecure nor safe from control system cyber threats
The US FDA is supposed to assure the US food supply is safe from adulteration. However, the FDA Food Safety Management Act (FSMA) requirements ignore cyber threats. There have been more than 20 control system cyber incidents in food and beverage facilities including some where people were harmed and others that shut down facilities. Similar […]
Observations from 2021 SANS ICS Cyber Security Conference
The 2021 SANS ICS Cyber Security Conference was held March 4-5, 2021 with almost 9,000 registrants globally. The Conference thoroughly addressed OT networking issues. However, cyber security issues associated with Level 0,1 devices were not as adequately understood and addressed. There was also almost no discussion of the hardware backdoors in the Chinese-made transformers. My […]