“Although you cross the Atlantic for years and have ice reported and never see it, at other times it’s not reported and you do see it.” – Charles Lightoller, Titanic Second Officer (speaking at the public inquiry into the sinking) In one of my recent lectures on “The cybersecurity dimension of critical energy infrastructure” I […]
Thoughts on possible misconceptions over the cybersecurity of the energy sector
“The pump don’t work, cause the vandals took the handles” – Bob Dylan The use of high technology (information technology and telecommunications) has entered almost every aspect of our lives. You name a sector and it is there: finance, trade, energy, communications, transportation, even education and healthcare. High tech is what modern society is built […]
Proposing innovative solutions to a problem which will require even more solutions is not a good way to go
– After the ship has sunk, everyone knows how she might have been saved. – Italian proverb In an earlier blog I wrote about the importance of answering the key questions in developing a strategy to secure a critical asset (1). I could see the consequences of not taking the time to fully comprehend these […]
Simulations don’t have to be expensive or labor intensive in order to explain key concepts about IT and ICS security
It can be hard to understand amidst all the IT biased (towards Confidentiality, Integrity and Availability of information) cybersecurity hoopla how today’s IT threats emanating from cyberspace can affect industrial control systems. IT security questions can be hard to understand for the ICS practitioner (who leans towards different security priorities of Safety, Availability, Integrity and […]
In seeking to protect industrial control systems are we clear about what is being threatened and from what threats?
Reading the recently published Industrial Control Systems Emergency Response Team (ICS-CERT) Advanced Analytical Laboratory (AAL) White Paper on Malware Trends left me somewhat unimpressed and disappointed. Whenever I read a document about cybersecurity, especially one written by an institution dealing with the security of industrial control systems, I am keen to see how the authors […]
Knowing about the tip of the iceberg is not good enough
A high official of the International Atomic Energy Agency (IAEA) is reported recently to have announced that a disrupting cyber incident took place at a nuclear power plant around two-three years ago. (1) He was quoted further saying “This issue of cyber-attacks on nuclear-related facilities or activities should be taken very seriously. We never know […]
Never has been a better time to practice one’s critical infrastructure attack skills
Last year was an interesting year for critical infrastructure protection. It began with the German Government’s Federal IT Department (BSI) issuing its yearly cyber incident report covering cyber incidents from the previous year. Noteworthy was the mention of a cyber-attack on the control systems of a steel mill that resulted in physical damage to the […]
SCADA Radio follies
I maintain several SCADA masters with licensed MAS radios. The older radios had served us long and well. However, we’re starting to see failures on the back side of the classic bathtub curve. Two days ago, we installed a new radio at one of our smaller master sites. This was our first swap-out of a […]
Denial of Service
Most in this business know who Brian Krebs is. He is well known for looking in the dark corners of the Internet for all sorts of obnoxious evil and documenting it. In the last day or two, he encountered what appear to be record levels of traffic aimed against his web site. His host, Akamai, […]
If control systems move back to analogue can we still keep our smart phones?
I have been following the discussion about the return to analogue. Both this and the Industry 4.0 movement are new to me and have put them on my “study this more” list. Recently a colleague sent me a paper, “The Case for Simplicity in Energy Infrastructure” (1) , which has captured my imagination. It very […]