When I first joined the water utility I discovered that my division chief, we’ll call him Ed, constantly projected himself as a crusty authoritarian figure. Every time someone would approach him with some “new idea,” perhaps even something he’d like to do, his first answer was almost always a resounding “No.” And unless they were […]
The US electric industry is not responding to cyber-vulnerable Chinese equipment
The electric grid is interconnected. The interconnectivity goes not only between utilities but also between facilities connected to the grid. The Chinese (and other threat actors) are exploiting this cyber security gap. Chinese transformers, cranes, inverters, process sensors, etc. are comparably well-made and inexpensive leading to their continued use in US critical infrastructures. Many of […]
False process sensor data can be catastrophic, but are not adequately addressed
The impetus for this blog was twofold: first, a Concordia University study dated January 24, 2024, which concluded that tampering with the electric system sensors could cause grid fluctuations, and second, my meeting with the engineer who scientifically documented that the radiation monitoring system outside the Chernobyl nuclear plant was compromised with false data. The […]
Getting Into OT
With all the public emphasis on infrastructure, many are asking how to “break into” Operational Technology (OT). It isn’t hard. But there are a few caveats. This blog is my experience and perceptions. There are others, so don’t take what I say as the only reality. There is a widespread perception that field work in […]
IEEE Computer article on identifying control system cyber incidents
The article “There Is No Chilling When Your Control System Cybersecurity Is Unfulfilling” is in the December 2023 issue of IEEE Computer magazine. The article discusses the importance of identifying control system incidents as being cyber-related as the identification is the starting point for cyber incident response programs. The example in the article is the shutdown of […]
Whose list of top cybersecurity events of 2023 is worth using?
Happy New Year everyone. As 2023 came to an end several “top 10” year-end cybersecurity lists were published by various organizations. One of them was by ESET a security company based in Slovakia that has provided much useful analysis and news about cybersecurity in the past. Its website claims it has “experienced researchers with in-depth […]
Why is CISA not addressing the PLCs in the Unitronics PLC attack?
The Unitronics PLC hack is an Iranian IRGC supply chain attack against multiple US critical infrastructures on US soil (it has also affected international users) targeting the Israeli-made Unitronics PLCs through its customers. The CISA response has been less than satisfactory as this was an attack against the PLCs whereas CISA’s recommendations only addressed IT […]
Iran hacks US water system: Observation and implications of a terrorist attack on US soil
November 25, 2023, the Municipal Water Authority of Aliquippa, PA had one of its booster stations hacked by an Iranian-backed cyber group – CyberAv3ngers. The booster station monitors and regulates pressure for customers within the City of Aliquippa and portions of two neighboring Townships. An alarm went off as soon as the hack had occurred […]
Cyber-related rail incidents have killed more than 490
Most rail cyber incidents have been IT cyberattacks. Existing government and industry cyber security guidelines have focused on these IT issues. The government and industry cyber security guidelines have often failed to address the control system cyber issues that have resulted in catastrophic control system cyber rail incidents. There have been more than fifty control […]
Forecasting where a hacker will go once inside an OT network
Work is ongoing in identifying cyber threats, and vulnerabilities, and locating hacker penetration in electric utility and other OT networks. However, existing technologies including IDS, IPS, SIEM, and SOAR can’t predict the future movement of a cyber intrusion that has successfully breached the OT network. Under US Air Force and DOE contracts, GCAS and its […]