3 ms·

As someone who has a more insider perspective on critical infrastructure perspective, I think that what really needs to change for the better is the culture of

by pnathan 14y ago

As someone who has a more insider perspective on critical infrastructure perspective, I think that what really needs to change for the better is the culture of awareness and understanding of modern software in the SCADA world. Right now it's where IT was in the early 90s, IMO. My personal opinion is that certain facilities and services (say, water management systems or the electric grid) must be federally regulated, with aggressive fines and various charges for negligence and slackness. There must be a real and definite risk factor to being a slacker. Right now, there isn't- not really. The risk is very small for the cost involved in upgrading infrastructure and having annoying security people telling you that the Internet is a source of problems and to stop communicating over telnet. :-) I used to follow the SCADASEC mailing list which had several excellent descriptions of the culture problem.

tptacek 14y ago
This, by the way, is the original Democratic "Rockefeller bill" take on the "cybersecurity" problem, and what I was actually invoking when I said Obama's preferred version of CISPA was worse than CISPA; what he actually came up with (this EO) is less bad than what I assumed he'd come up with (the Rockefeller bill). In short: The Rockefeller solution to the critical infrastructure problem is: 1. Allow the government to, with some due process mechanism, designate private entities as "critical infrastructure" 2. Allow the government to define, more or less by fiat, a set of qualified auditors for critical infrastructure 3. Mandate that critical infrastructure operators get audited
- pnathan 14y ago
  Without being a policy analyst for the CIP world, just a guy who writes code in it, these seem like a good idea. The only thing I would add is a point 4- failing audits should hurt/cost. There needs to be an incentive to not fail. The key problems to avoid lie around point 2. It can not become a case of regulatory capture. Nor, for that matter, should be a bunch of IT security yahoos who don't understand the unique demands that CIP/SCADA systems have. (By the way, if anyone wants to talk about this sort of thing, feel free to email me).

by pnathan 14y ago

tptacek 14y ago

This, by the way, is the original Democratic "Rockefeller bill" take on the "cybersecurity" problem, and what I was actually invoking when I said Obama's preferred version of CISPA was worse than CISPA; what he actually came up with (this EO) is less bad than what I assumed he'd come up with (the Rockefeller bill). In short: The Rockefeller solution to the critical infrastructure problem is: 1. Allow the government to, with some due process mechanism, designate private entities as "critical infrastructure" 2. Allow the government to define, more or less by fiat, a set of qualified auditors for critical infrastructure 3. Mandate that critical infrastructure operators get audited

pnathan 14y ago
Without being a policy analyst for the CIP world, just a guy who writes code in it, these seem like a good idea. The only thing I would add is a point 4- failing audits should hurt/cost. There needs to be an incentive to not fail. The key problems to avoid lie around point 2. It can not become a case of regulatory capture. Nor, for that matter, should be a bunch of IT security yahoos who don't understand the unique demands that CIP/SCADA systems have. (By the way, if anyone wants to talk about this sort of thing, feel free to email me).