A virtual cross-industry meeting was held on January 5th, 2022 under the purview of IEEE, with universities and standards development and industry organizations representing a cross-section of critical infrastructures. Essentially, “a coalition of the willing”. As process sensors are used in all sectors, the intent of the meeting was to create outcomes and a way […]
There’s more to control system cybersecurity than IT and OT networks – TSA is missing that distinction
Control system cyber incidents affecting pipelines, rail, and aviation have caused catastrophic damage resulting in multi-billion-dollar impacts and hundreds of deaths. Detecting cyberattacks against IT and OT networks can be done today. However, the same cannot be said for detecting control system cyber incidents (attacks and unintentional incidents) that occur with the cyber insecure control […]
Power grid cyber security recommendations still don’t address key grid cyber vulnerabilities
In August 2021, DNV published DNV-RP-0575, “Recommended Practice, Cyber security for power grid protection devices”. The Recommended Practice is important as it was developed based on the results of a joint research and development project with Fingrid (Finland), Stattnet SF (Norway), and Svenska Kraftnet (Sweden) and used by T&D India following the Chinese cyberattacks. The […]
The utilities are not addressing the cyber security that will keep lights on
On November 16-17, 2021 the utility industry conducted its biennial grid security exercise – GridEx VI. The exercise addressed the hybridized attacks of IT and OT networks which included ransomware as well as physical security. The lack of cybersecurity in the grid’s process sensors is a common mode vulnerability that affects both situational awareness and incident […]
Addressing Chinese-made equipment in the electric industry – a success story
Monday, November 15, 2021 a public utility commission in a hearing on a major new transmission project referenced my blog on the DNI report on Chinese-made transformers, https://www.controlglobal.com/blogs/unfettered/dni-identifies-chinese-transformers-as-cyber-vulnerable-risks-yet-doe-and-industry-ignore-the-threat/ in a question to the utility. In response, the utility stated they would not be using Chinese-made transformers in this project. I consider that to be a […]
The gaps preventing cyber securing physical infrastructures
Physical infrastructures are monitored and controlled using instrumentation and control systems. Instrumentation monitors the processes and control systems control the physics. I have not used the term “critical infrastructure” as these issues apply to any physical infrastructure. Yet, instrumentation and the physics of the processes are often ignored as the focus of security experts is […]
DNI identifies Chinese transformers as cyber vulnerable risks yet DOE and industry ignore the threat
A DNI National Intelligence Estimate states: “Deployment of utility-scale solar and wind technologies in remote areas is likely to require ultra-high-voltage transmission lines to move the power to cities. China is the world’s leading supplier of advanced grid components for ultrahigh-voltage systems, such as transformers, circuit breakers, and inverters, which we assess creates cyber vulnerability […]
Comments to the US Secretary of Energy’s Advisory Board on lack of process sensor cyber security
October 28, 2021, I gave a presentation to the US Secretary of Energy’s Advisory Board (SEAB) on the need for process sensor monitoring. The SEAB meeting can be found at https://www.energy.gov/seab/seab-meetings as well as my prepared presentation. My short presentation is at approximately the 1 Hour 20-minute timeframe. In the SEAB meeting, DOE was looking […]
Electric distribution reclosers can be cyber compromised to cause devastating wildfires
October 13, 2021, the San Jose Mercury News had the following headline: “High-wire act for PG&E: balancing safety, reliability”. PG&E is facing lawsuits and pleaded guilty to 84 counts of voluntary manslaughter in a 2018 blaze that nearly destroyed the town of Paradise. Consequently, PG&E is taking a zero-tolerance approach to “arcing,” which happens when […]
IIOT session on control system cyber security – Why hasn’t control system cyber security been solved yet?
October 6, 2021, 2-2:55pmEastern, I will be moderating a session on control system cyber security entitled “Why haven’t we solved control system cyber security yet?” The session was originally entitled “Protection for SCADA systems, plant control systems, PLCs, and other field control devices”. However, the title and session direction changed when it was recognized that […]