3 ms·

Fortunately, I don't see this particular type of cyber warfare existing for very long. Nobody with expensive industrial computers is going to mess around when i

Fortunately, I don't see this particular type of cyber warfare existing for very long. Nobody with expensive industrial computers is going to mess around when it comes to security, and it should not be difficult at all to fully insulate SCADA systems from malware. It worked this time because nobody was expecting it, but no target worth attacking in this way is going to let it happen again.

cnvogel 16y ago
I think you are oversimplifying the situation. With any plant of sufficient size, there will be a lot of people involved in commissioning, servicing and operating it. This makes "fully insulating" SCADA systems much harder. Management people will demand to get data from the plant to manage utilization. Servicing personnel will want to connect their laptops to the automation systems to talk to their company's devices that are installed in the plant during maintenance. ... ... So, for military projects where integrity/secrecy is a value for itself, I can imagine draconian regulations to be in place soon, or most likely they already are. But for "normal" industrial plants where there's a need for money to be made, there always will be a balance between IT security and pragmatism in running the damn thing. And if diagnosing a failed motor controller in a stalled plant is delayed because IT security prohibits the technician from inserting his USB stick, I can tell you how the discussion with the plant manager will turn out in 99% of all cases.
- extension 16y ago
  But for "normal" industrial plants where there's a need for money to be made, there always will be a balance between IT security and pragmatism in running the damn thing. And those plants likely don't have enemies powerful or motivated enough to attack them in this way. Typical black hats these days are in it for the cash and I don't see how sabotaging a factory could be made into cost effective fraud.

cnvogel 16y ago

I think you are oversimplifying the situation. With any plant of sufficient size, there will be a lot of people involved in commissioning, servicing and operating it. This makes "fully insulating" SCADA systems much harder. Management people will demand to get data from the plant to manage utilization. Servicing personnel will want to connect their laptops to the automation systems to talk to their company's devices that are installed in the plant during maintenance. ... ... So, for military projects where integrity/secrecy is a value for itself, I can imagine draconian regulations to be in place soon, or most likely they already are. But for "normal" industrial plants where there's a need for money to be made, there always will be a balance between IT security and pragmatism in running the damn thing. And if diagnosing a failed motor controller in a stalled plant is delayed because IT security prohibits the technician from inserting his USB stick, I can tell you how the discussion with the plant manager will turn out in 99% of all cases.

extension 16y ago
But for "normal" industrial plants where there's a need for money to be made, there always will be a balance between IT security and pragmatism in running the damn thing. And those plants likely don't have enemies powerful or motivated enough to attack them in this way. Typical black hats these days are in it for the cash and I don't see how sabotaging a factory could be made into cost effective fraud.