Security matters SCADA

Security Matters: Utilities vulnerable after IT migration – Article taken from the FT (Financial Times)
By Ken Munro
The word “hackers” usually brings up visions of villains trying to crack bank accounts, identity theft and the like, but rarely the stability of critical infrastructures such as water, gas and electricity.

One weakness is a failure to segregate the two networks, which means that any employee on the network can access the Scada systems.

As a result, Scada networks are being migrated to the TCP/IP Ethernet network – the one used to access the internet, to carry internet phone calls, send e-mail and so on.

A related worry is that no one might know if a power cut was the result of a normal system overload or of a hacking event.

Electrical power grids in the eastern US have weak control systems (witness the north-east blackout of 2003), so it would not take much to take them out.

Scada has hardly ever been hacked into, partly because it uses arcane technology that only a small number of specialists have the skills to manipulate.

Scada systems were good at running on old, slow networks using unusual protocols to communicate.

Such bodies are now faced with the daunting task of upgrading out-of-date Scada systems while striving to prevent a security breach or system failure.

Further, there are many concerns about the stability of Scada networks when migrated to IP, because of the bespoke equipment they use.

Electrical power grids in the eastern US have weak control systems (witness the north-east blackout of 2003), so it would not take much to take them out.

As a result, Scada networks are being migrated to the TCP/IP Ethernet network – the one used to access the internet, to carry internet phone calls, send e-mail and so on.

The average hacker might be more interested in stealing data, or defacing a website, but motivations vary: there is already extensive evidence of state-sponsored cyber-attacks.

Yet the chaos that would ensue if these were hijacked perhaps ought to raise the greatest alarm; and such a disaster is becoming more of a possibility because of changes in the systems that control them.

Indeed, there is only one documented case I am aware of, to do with pollution of a watercourse in Australia.

In the UK it is one faced by the Centre for Protection of National Infrastructure, which watches over and works with utilities to ensure they take account of both physical and electronic security.

Scada (Supervisory Control and Data Acquisition) and its systems enable the utilities to function safely and consistently.

Security Matters: Utilities vulnerable after IT migration – Article taken from the FT (Financial Times)
By Ken Munro
The word “hackers” usually brings up visions of villains trying to crack bank accounts, identity theft and the like, but rarely the stability of critical infrastructures such as water, gas and electricity.

With a growing international ownership of utility companies, assuring continuity of supply in a changing political climate is a challenge.

In the UK it is one faced by the Centre for Protection of National Infrastructure, which watches over and works with utilities to ensure they take account of both physical and electronic security.