3 ms·

SCADA vendors have been way too caviler about collecting data from the "plant floor" for the "front office" with technologies that weren't designed with a threa

SCADA vendors have been way too caviler about collecting data from the "plant floor" for the "front office" with technologies that weren't designed with a threat model that even remotely approaches a run-of-the-mill LAN, let alone the Internet. Never mind protocols that have no provision for authentication or encryption-- we're talking about embedded devices that fall over and die when port-scanned or when they receive "too many" broadcasts. Network segmentation is usually difficult in these environments too. Inevitably, there's a piece of software and the associated devices it controls that have to layer 2-adjacent to "discover" each other and communicate. The SCADA vendor sets the expectation that a "front office" computer should be able to interface just fine with the "plant floor" and blames the meddling IT department with their subnets and default gateways and ACLs for things not working. (I may have some pent up frustration on this topic.) Aside from the technical limitations of some of these platforms there's a cultural issue. Controls engineers aren't trained in Infosec. The software and device manufacturers are developing better products, but I don't feel like there's a "secure by default" initiative. It still takes skills on the part of the installer. I still see a huge lack of consideration for security in the people actually installing gear (at least in the small-to-medium sized manufacturing companies and small municipalities I work around). The biggest concerns are making sure vendor's support personnel can troubleshoot remotely because frequently the on-site personnel have limited skills. That's how we end up with TeamViewer, VNC forwarded thru routers, etc.

kodah 6y ago
> The biggest concerns are making sure vendor's support personnel can troubleshoot remotely because frequently the on-site personnel have limited skills. That's an excellent call-out. City salaries will almost never employ the type and level of personnel to do anything beyond maintaining the status quo typically.
- m4x 6y ago
  It's more than just a lack of salary. There simply isn't enough technical work to keep highly skilled engineers busy at your typical industrial or infrastructure sites. Even if you had the funds to employ highly trained engineers, most sites couldn't give them enough work to keep their skills sharp.
ocdtrekkie 6y ago
A lot of the failure is just the basics, and it's not always technical incompetence. It can be managerial. For instance, most SCADA and IT vendors can do a lot better than (probably not patched) Windows 7 with TeamViewer. However, there's two prevailing attitudes that interfere: 1. We're not big like Boston or New York, therefore we're not going to be targeted and are fine, nobody cares to harm us. 2. When you have a working SCADA system, nobody wants to run updates or make security policy changes when that might lead to not having a working SCADA system. Security vulnerability remains the constant invisible bogeyman, you never know if you did enough until it's too late.
- dylan604 6y ago
  > 1. We're not big like Boston or New York, therefore we're not going to be targeted and are fine, nobody cares to harm us. If enough events keep occurring (and why would we suspect they won't), this attitude will HAVE?? to change. Kids will learn about it, and do it for the lulz. The city of Dallas had its tornado sirens hacked, and at least in the local areas, it brought some attention to the subject. Eventually, the bored teenagers in the small towns are going to do it just because.
  - ocdtrekkie 6y ago
    Yeah, I think every time an incident like this occurs, it provides a new cautionary tale where people can see how mistaken that attitude is.
  - TeMPOraL 6y ago
    > Eventually, the bored teenagers in the small towns are going to do it just because. Not just locally. If you're trying to mess up an industrial system to see it mentioned in the local newspaper few days later, you may just pick a random system from Shodan, note its location, and check their local newspaper.

kodah 6y ago

> The biggest concerns are making sure vendor's support personnel can troubleshoot remotely because frequently the on-site personnel have limited skills. That's an excellent call-out. City salaries will almost never employ the type and level of personnel to do anything beyond maintaining the status quo typically.

m4x 6y ago
It's more than just a lack of salary. There simply isn't enough technical work to keep highly skilled engineers busy at your typical industrial or infrastructure sites. Even if you had the funds to employ highly trained engineers, most sites couldn't give them enough work to keep their skills sharp.

ocdtrekkie 6y ago

A lot of the failure is just the basics, and it's not always technical incompetence. It can be managerial. For instance, most SCADA and IT vendors can do a lot better than (probably not patched) Windows 7 with TeamViewer. However, there's two prevailing attitudes that interfere: 1. We're not big like Boston or New York, therefore we're not going to be targeted and are fine, nobody cares to harm us. 2. When you have a working SCADA system, nobody wants to run updates or make security policy changes when that might lead to not having a working SCADA system. Security vulnerability remains the constant invisible bogeyman, you never know if you did enough until it's too late.

dylan604 6y ago
> 1. We're not big like Boston or New York, therefore we're not going to be targeted and are fine, nobody cares to harm us. If enough events keep occurring (and why would we suspect they won't), this attitude will HAVE?? to change. Kids will learn about it, and do it for the lulz. The city of Dallas had its tornado sirens hacked, and at least in the local areas, it brought some attention to the subject. Eventually, the bored teenagers in the small towns are going to do it just because.
- ocdtrekkie 6y ago
  Yeah, I think every time an incident like this occurs, it provides a new cautionary tale where people can see how mistaken that attitude is.
- TeMPOraL 6y ago
  > Eventually, the bored teenagers in the small towns are going to do it just because. Not just locally. If you're trying to mess up an industrial system to see it mentioned in the local newspaper few days later, you may just pick a random system from Shodan, note its location, and check their local newspaper.