SCADASEC blog website is now secure

Our web site before was not completely secured, and we used self-signing certificates as an interim measure to ensure that the site was secure. Since we are not conducting e-commerce of any kind, the need for über super-secret security wasn’t necessary. Our choice was to use a more cost-effective CA provider called ‘Comodo’. Widely used […]

The SolarWinds hack can directly affect control systems

A highly sophisticated Russian Intelligence group has compromised the SolarWinds Orion platform which has an estimated 18,000 customers and an unknown but vast number of sites. The SolarWinds advisories and webinars have focused on the IT networks, network visibility, and data exfiltration/compromise. However, SolarWinds is also used to directly monitor and CONTROL SNMP devices including […]

Lack of IoT HVAC control system cyber security and potential real-world impacts

A new IoT valve/actuator from a major HVAC equipment supplier has not only no device security. A further look at the supplier’s catalog shows additional products that communicate using common building insecure communication protocols such as BACnet and Modbus. The ability to remotely control these valves/actuators allows for unauthorized control of a building’s environmental control […]

The Chinese hardware backdoors can cause transformer failures through the load tap changers

As I was reviewing my blogs for a paper I was preparing, I found a nuclear power plant incident involving a station auxiliary transformer load tap changer (LTC) failure. Substation transformers have been acknowledged as the Achilles heel of the electric industry. As a result, the 2015 FAST (Fixing America’s Surface Transportation) Act contained a […]

Need for an operational cyber capacity before promptly and effectively acting on threat intelligence

“The pump don’t work cause the vandals took the handles[1]” – Bob Dylan, Subterranean Homesick Blues. “Threat intel” and the vendors who are eagerly trying to offer it are very much in our cybersecurity information space.  It sounds like a good idea.  One gets a tip that something is about to target your operations next […]

Convergence of What?

I have seen it. I know you have probably seen it too. It’s that dreaded “Convergence of IT and OT”. It’s the buzz-phrase that just won’t quit. Another buzz-phrase that I keep seeing is Industry 4.0. Most people who toss these terms around are probably not aware of the starkly different philosophies behind them. Convergence […]

Animated logo?

I’ve been noodling around with developing an animated intro for SCADASEC. Based on the consensus of 8 individuals, this was the intro that they thought would have the best impact. My thanks to those who’ve agreed to vote on our new animated logo – thank you. Comments made included providing something ‘hard code’, theatrical, and […]