Slashdot Mirror
Utilities Racing To Secure Electric Grid
FreeMichael61 writes "In the latest episode of Spy vs. Spy, China rejects accusations it's hacking U.S. companies to steal IP or bring down the grid. But there's no doubt the grid can be hacked, CIO Journal's Steve Rosenbush and Rachael King report. Industrial control networks are supposed to be protected from the Internet by an air gap that, it turns out, is largely theoretical. Internal security is often lax, laptops and other devices are frequently moved between corporate networks and control networks, and some SCADA systems are still directly connected to the internet. What security standards actually exist are out of date and don't cover enough, and corporations often use questionable supply chains because they are cheaper."
Theoretical Air Gap!
When information is power, privacy is freedom.
... why are mission critical devices connected to the internet
sure we know that the weakest link is the meatware, not the hardware, but still...
Looking for people to chat about multicopters, coding, music. skype: gtsiros
Anyone with a web-server will tell you that they are seeing dozens of penetration attempts daily, even right now. I also see this on my home ADSL line. I'm not saying the government there is doing it, but I do know that there is no other country which is attacking everything everywhere this aggressively. I don't have any web pages in Chinese and I wonder if I would be better off just using one of those iptables -j DROP lists who list all IPs in China.
9/11: Never forget it was a false-flag operation
China benefits from a functional United States. So long as the benefits outweigh any prize that would remove them in the taking, Americans are fairly safe from Chinese attack.
Do you think that the energy industry is any easier on IT folks than anybody else?
Big dollar consultants instead of trained employees, given full unescorted access because the manager doesn't want to have to sit in the datacenter and escort them to the restrooms and such.
My SCADA datacenter still allows a cleaning crew in unescorted.
And electricians, and HVAC contractors and so on.
I found out they were PAINTING my datacenter the day that my storage started freaking out with heat alarms. Went running downstairs to find the facilities team had left a painting crew in the datacenter to cover all of my cabinets (and vented tiles) with tarps.
So these devices might not start connected to the internet, but a USB key here, a rogue cellular wi-fi bridge there, and some wild stuff can happen.
I've heard of other shops that had their SCADA people upset that they couldn't work from home, so they set up "secret" networks that only they knew about so they could still get in. Secret to their co-workers/management, but easy to find for the people who do that for a living.
Going anon for good reason.
The problem comes from the previous generation of smart meter addressing which included broadcast groups and whose keys were managed by the utilities via HSMs. The tech is solid, but when you are dealing with utilities whom have very little real sophistication on the IT side dealing with crypto technologies they don't understand, bad things can and will happen.
Get access to the HSM at the provider, or the smart cards they've backed up keys onto, and you can forge a packet that will trigger a significant number of meters. All that could go away if we simply required truck rolls for turn-offs, but that is the most marketable aspect that drives adoption (that and turning on 8 confusing pricing tiers which they help shift the "blame" for a high bill from the utility charging more to the user who "chose to run that A/C during the hottest time of the day".
Grr.
Half of these articles don't even hide the fact that they're written and promoted by people that are looking for government money to secure infrastructure. Often it's even infrastructure that they own and that they're responsible for. One such person is even named in the first sentence of this article.
We're all in danger! Quick better make some new laws, imprison a few more people, and find a hero that can protect us!
One of my clients is a large electric utility. Their security, both physical and for IT systems, is top notch. None of their SCADA systems are online, they do routine and regular audits of all security, and even 'trusted' people like myself have to jump through hoops to get into the Data Center, and are always escorted.
They have really cool doors to get in too. They are like decontamination booths. You step into a vertical tube and wait to be cleared then the tube rotates and opens the other side.
On the other hand, I've done work for other utilities where yes, the cleaning crew goes in through what amounts to an open door, without an escort.
Change those systems from IP to ARCNET (or AppleTalk, or IPX, or ???).
"National Security is the chief cause of national insecurity." - Celine's First Law
Because mission critical devices may not be manned. This is a rising trend in remote asset management. It's used extensively in upstream processing and pipelining that is slowly working it's way to downstream.
Heck one large gas ... manufacturer (though it's hard to call air separation "manufacturing") in our country runs all plants remotely. Sure there are staff there, but no one in the control room, no one in front of the computers. The onsite staff are used to bring the plant online and handle emergency cases but as soon as a steady state is achieved the controls are handed over to a dedicated team in another country, who run these almost identical plants all over the world.
Airgap in this case is cutting off control.