4 ms·

What is exactly is the value of having any of our utilities connected to the internet? It seems the security risk is too high. It is bad enough we have to rel

What is exactly is the value of having any of our utilities connected to the internet? It seems the security risk is too high. It is bad enough we have to rely on people not inserting a bad USB drive or other physical plant problems.

kobayashi 9y ago
Terrible planning of legacy systems (and some current ones) from people who never gave any thought to security is how we got here. The value is usually negligible.
- jagermo 9y ago
  This right here. Most of these systems are not new or not even from one vendor. Takovers and mergers create networks, that give most sys-admins nightmares. The people who set these things up in the 50s or even 70s did not think about networking, let alone digital security. Most are retired. It would be extremely expensive to replace all infrastructure ad once, so most will be upgraded as we go along, creating new problems but also hopefully mitigating older bugs.
mtgx 9y ago
IoT would be my guess.
brownbat 9y ago
Partly money. "Rolling a truck" is one of the most expensive operational costs for a utility. Sending people places to fix problems is not ideal, especially when those places can be substations or transformers in the middle of nowhere. Partly, sometimes, people don't understand what systems are connected to which networks. Maybe it's a logical misunderstanding -- they're leasing a communications path that they don't realize is connected to the Internet. Sometimes it's a physical misunderstanding, they just never diagrammed everything and have no idea what's isolated and not.
snowwindwaves 9y ago
I work on about 30 different power plants on two continents and spend only 2 months a year on the road.
- protomyth 9y ago
  If there is an bug in the software that allows a security exploit, what prevents problems on two continents?
  - snowwindwaves 9y ago
    Nothing, but they are not my problems since I am EE not IT.
ac29 9y ago
The article never once uses the term "internet", and indeed many of these SCADA networks probably aren't connected to the internet. I've worked on a handful of them (no power utilities though), and the state of security is pretty bad. -Physical security ranges from OK to non existent. A smile and a wave can get you lots of places. Many things that could be locked, aren't. -I've seen many, many alarmed doors and areas where there is a large "Enter 12345 to disable alarm" taped to the alarm panel -Default passwords are never changed on lots of equipment -When default passwords aren't used, often times the passwords are taped or written on equipment -Radio networks are often unsecured (authentication and encryption simply dont exist on lots of older radio equipment, a cheap SDR could let you discreetly access sensitive communications in some cases). Modern radio networks can be much better, though (this is my area of expertise). Still, you'd need a lot of domain specific knowledge to pull off a successful attack.

kobayashi 9y ago

Terrible planning of legacy systems (and some current ones) from people who never gave any thought to security is how we got here. The value is usually negligible.

jagermo 9y ago
This right here. Most of these systems are not new or not even from one vendor. Takovers and mergers create networks, that give most sys-admins nightmares. The people who set these things up in the 50s or even 70s did not think about networking, let alone digital security. Most are retired. It would be extremely expensive to replace all infrastructure ad once, so most will be upgraded as we go along, creating new problems but also hopefully mitigating older bugs.

mtgx 9y ago

IoT would be my guess.

brownbat 9y ago

Partly money. "Rolling a truck" is one of the most expensive operational costs for a utility. Sending people places to fix problems is not ideal, especially when those places can be substations or transformers in the middle of nowhere. Partly, sometimes, people don't understand what systems are connected to which networks. Maybe it's a logical misunderstanding -- they're leasing a communications path that they don't realize is connected to the Internet. Sometimes it's a physical misunderstanding, they just never diagrammed everything and have no idea what's isolated and not.

snowwindwaves 9y ago

I work on about 30 different power plants on two continents and spend only 2 months a year on the road.

protomyth 9y ago
If there is an bug in the software that allows a security exploit, what prevents problems on two continents?
- snowwindwaves 9y ago
  Nothing, but they are not my problems since I am EE not IT.

ac29 9y ago

The article never once uses the term "internet", and indeed many of these SCADA networks probably aren't connected to the internet. I've worked on a handful of them (no power utilities though), and the state of security is pretty bad. -Physical security ranges from OK to non existent. A smile and a wave can get you lots of places. Many things that could be locked, aren't. -I've seen many, many alarmed doors and areas where there is a large "Enter 12345 to disable alarm" taped to the alarm panel -Default passwords are never changed on lots of equipment -When default passwords aren't used, often times the passwords are taped or written on equipment -Radio networks are often unsecured (authentication and encryption simply dont exist on lots of older radio equipment, a cheap SDR could let you discreetly access sensitive communications in some cases). Modern radio networks can be much better, though (this is my area of expertise). Still, you'd need a lot of domain specific knowledge to pull off a successful attack.