3 ms·

Back during SQL Slammer (IIRC) I was working in security and subsequently SCADA security for critical infrastructure. There was a well known story about a nucle

by erentz 8y ago

Back during SQL Slammer (IIRC) I was working in security and subsequently SCADA security for critical infrastructure. There was a well known story about a nuclear plant in the US that had its network taken down by the worm. The problem was they had become so reliant on automation that only had two operators on duty, not nearly enough. The lesson too often ignored I quickly found all over in the critical infrastructure space was, yes, the software is terribly insecure, but more critically when all is well organizations develop an overreliance on automation always going well meaning they’re under equipped for when it stops going well.

archgoon 8y ago
Is this the incident? https://www.securityfocus.com/news/6767 https://www.securityfocus.com/news/6767 'The Slammer worm penetrated a private computer network at Ohio's Davis-Besse nuclear power plant in January and disabled a safety monitoring system for nearly five hours, despite a belief by plant personnel that the network was protected by a firewall, SecurityFocus has learned. The breach did not pose a safety hazard. The troubled plant had been offline since February, 2002, when workers discovered a 6-by-5-inch hole in the plant's reactor head. Moreover, the monitoring system, called a Safety Parameter Display System, had a redundant analog backup that was unaffected by the worm. But at least one expert says the case illustrates a growing cybersecurity problem in the nuclear power industry, where interconnection between plant and corporate networks is becoming more common, and is permitted by federal safety regulations.' Sounds like the plant was being operated by a skeleton crew since it was mostly disabled.
- erentz 8y ago
  That could be it but that sounds much less concerning than how the guy at INL who was telling me about it described it. He may have enhanced the story. :-)

by erentz 8y ago

archgoon 8y ago

Is this the incident? https://www.securityfocus.com/news/6767 https://www.securityfocus.com/news/6767 'The Slammer worm penetrated a private computer network at Ohio's Davis-Besse nuclear power plant in January and disabled a safety monitoring system for nearly five hours, despite a belief by plant personnel that the network was protected by a firewall, SecurityFocus has learned. The breach did not pose a safety hazard. The troubled plant had been offline since February, 2002, when workers discovered a 6-by-5-inch hole in the plant's reactor head. Moreover, the monitoring system, called a Safety Parameter Display System, had a redundant analog backup that was unaffected by the worm. But at least one expert says the case illustrates a growing cybersecurity problem in the nuclear power industry, where interconnection between plant and corporate networks is becoming more common, and is permitted by federal safety regulations.' Sounds like the plant was being operated by a skeleton crew since it was mostly disabled.

erentz 8y ago
That could be it but that sounds much less concerning than how the guy at INL who was telling me about it described it. He may have enhanced the story. :-)