Experts Call For Preserving Copper, Pneumatic Systems As Hedge For Cyber Risk (securityledger.com)

chicksdaddy quotes a report from The Security Ledger: The United States should invest resources in preserving aging, analog infrastructure including telecommunications networks that use copper wire and pneumatic pumps used to pump water as a hedge against the growing threat of global disruption resulting from a cyber attack on critical infrastructure, two researchers at MITRE argue. The researchers, Emily Frye and Quentin Hodgson with The MITRE Corporation, note that critical infrastructure is increasingly run from converged IP (Internet Protocol) based networks that are vulnerable to cyber attack. That includes so-called "lifelines" -- essential functions like water, electricity, communications, transportation and emergency services. That marks a critical departure from the past when such systems were isolated from the internet and other general purpose networks. "Each lifeline rides on, and is threaded together by, digital systems. And humans have yet to design a digital system that cannot be compromised," they write. With such civilization-sustaining functions now susceptible to attack, the onus is on society to maintain a means of operating them that does not rely on digital controls, Fry and Hodgson write. In many cases, that means preserving an older generation of analog infrastructure and management systems that could be manually operated, The Security Ledger reports. From their article: "In the case of communications, for instance, what is required is the preservation of a base core of copper-enabled connectivity, and the perpetuation of skills and equipment parts to make analog telephones work. Today, we see a move to decommission the copper-wire infrastructure. From a pure business standpoint, decommissioning copper is the right thing to do; but from a public-safety and homeland security perspective, we should reconsider. Decommissioning copper increases homeland security risk, because failover planning calls simply for relying on another server, router, or data center that is also subject to compromise."

Comments

Copper is also digital

[Anonymous Coward]

What they want is to go back to to the switch board lady-times.

Re:Copper is also digital

[vtcodger]

Of course not. What they want is to quit using an obviously insecure technology designed for entertainment and casual communication for command and control of critical infrastructure. Maybe the internet can actually be secured. But so far, all the signs seem to say that it can not be -- at least not any time soon.

Like the his faithful Indian companion Tonto used to ask the old Lone Ranger. "What now Kimosabe?"

At least, these guys have a plan of sorts. Leave the phone lines in place. The financial community's response to similar problems is to pretend the problems don't exist. Anyone want to bet on THAT ending well?

Re:Copper is also digital

[TheRaven64]

Maybe the internet can actually be secured. But so far, all the signs seem to say that it can not be -- at least not any time soon

The Internet is pretty secure. The issues with unauthenticated updates to BGP were fixed a couple of years back and I don't remember anything major since then. The endpoints connected to the Internet are a very different matter, but unless you're advocating typewriters then they're largely unavoidable.

Re: Copper is also digital

[Anonymous Coward]

The internet was not designed (in spirit) for what you think it was, but it was designed by idealogues for sure. The recreation and entertainment functions are insecure applications built upon common infrastructure in the same way that doors Ford Pintos one freely roamed the highways.

Re: Copper is also digital

[Anonymous Coward]

So... Hand switched operators.

PSTN is switched. It has electronics.

There's fuck all different between it and fibre.

If they were arguing for short wave analogue radio, it would make more sense. That, at least can be very primitive. PSTN is far more advanced than analogue radio.

Re:Copper is also digital

[rgbatduke]

Hey, somebody could break into my den and use my typewriter to write ransom notes. Or they could steal my pen and use it to send out advertisements to oh, a dozen other people. Since my front door lock is a zwave device, they could even do this as part of a cyberattack.

This is only half kidding. From times ancient, computer security has been a tradeoff between the risks associated with any given level of security and the benefits obtained by operating at that level. You can run your computer wearing no clothes and having just passed through an x-ray machine and a 2 Tesla magnet, with dual isolation power inside a faraday cage itself inside a locked down secure facility that requires retinal scans and a realtime DNA match to allow you into the room followed by the correct entry of a 240 character random password to login, but you aren't going to get a lot of productive work done with no internet and an icy cold ass. Or you can run an ordinary laptop (like my Lenovo) with a reasonably secure OS (Fedora 25 on a fully encrypted SSD) with moderately aggressive network blocks on all ports but 22 for ssh, use only bidirectionally encrypted channels for all secure traffic, and avoid doing really stupid things (like downloading and running darkweb apps and content) and be pretty reasonably safe AND still be able to get a fair amount of work done when you aren't screwing around replying to things on /. :-) Is my system secure, truly secure? Hell no. But it is, as you say, "pretty secure" and it is STILL USEFUL.

Saving "copper" doesn't even make sense from a security point of view. There is nothing special about copper vs fiber or radio. And what do they mean? Twisted pair? Cat 5 ethernet? Time-Warner (sorry, "Spectrum") coax cable? Uh huh. They mean cable, not twisted pair, not phone lines.

This sounds like legislative rescue for TWCpectum, probably in response to whining about the demise of their near-monopoly on "copper" as fiber ripples through the world replacing the copper with something faster and much, much cheaper.

I don't even understand what they could be asserting regarding the security of "copper" vs alternatives. Copper, fiber, radio all carry encoded signals. Radio is by far the least secure as a transmission medium, with the signal openly available to everybody in range. Copper is easy to tap, and can often be tapped without even breaking the physical medium with an actual insertion via short range near field transducers. Fiber is actually the most difficult to tap, and is the most likely medium to have detectable artifacts from tapping. Intermediate hardware ALL is pretty much equally hackable, although again fiber probably wins the signal reamplification game as one doesn't have to read, then rewrite, every packet to boost fiber signals, where most wire repeaters do, and hence are hackable. And when we get to the network itself, the routers and major switching stations, the core stuff is usually professionally managed and "probably" pretty secure, the end stage stuff (cable modems, WAPs, etc) is probably vulnerable as hell but irrelevantly so as long as you use only secure point to point channels for work, and the BIGGEST vulnerability, proven over and over, is the operating system and applications on your actual computer or personal digital device.

I'm sure that there are official lists somewhere, but my impression after doing this stuff for many decades is that if you run Windows (almost any version, although by the end XP wasn't horribly insecure if you avoided e.g. explorer and outlook) then whether your network is "copper" or "fiber" or "radio" is almost completely irrelevant to your total risk. If you run IOS you are "pretty secure". If you run most versions of Linux and don't do really stupid things you are "prettier securer". If you run any of these -- even Windows -- and know what you are doing, you can boost "prettier securer" to as close as you like to "prettiest securest", completely independent of the networ

Re:Copper is also digital

[Anonymous Coward]

Easy Peasy. I got the answer to all you pesky security problems right here in my pocket.

It's called "build a second freakin' network controlled and maintained by a private organization and put all your stupid machines on that".

Thank you.

Re: Copper is also digital

[AvitarX]

I'm pretty sure copper meant anologue twisted pair, and was meant as a stand in for "80s and before tech "

The pneumatic tubes I took to mean mechanical switches, rather than wires and computers to switches. For example the NYC subway still has pneumatic controls in points.

I don't see any advantage to direct dial and modems vs the internet though. A firewall can do the same thing.

Re:Copper is also digital

[swillden]

What they want is to quit using an obviously insecure technology designed for entertainment and casual communication for command and control of critical infrastructure.

You have that backwards. The Internet was originally designed for command and control of critical (military) infrastructure. One of the core design goals was that it be able to survive nuclear war, which it does by supporting multiple paths for data, with automatic re-routing. We repurposed this military design first for education and then later for business and entertainment, and now for nearly everything.

Maybe the internet can actually be secured. But so far, all the signs seem to say that it can not be -- at least not any time soon.

Nonsense. The Internet is quite secure. But to make that statement mean anything we have to define what "secure" means in this context. What it means in this case is that the Internet delivers packets from point A to point B with high reliability, and that it's infeasible to cause large scale misrouting or packet loss. It does that extremely well. It's not terribly difficult to disrupt specific links in the vast network, but that only affects the nodes serviced by the affected link -- and then only if the nodes don't have any redundant connectivity.

Now, the endpoints, those we clearly are not very good at securing. But that's not the Internet's fault. This isn't just semantics, either. When you distinguish the connectivity fabric from the endpoints, it makes the risks much clearer. The problem isn't that the Internet is in any way insecure or defective, the problem is that people are connecting insecure nodes that manage critical infrastructure to this globally-accessible network. I may be sitting in a Starbucks in Moscow, and attacking a power delivery substation in New York City. The Internet will be faithfully doing its job of delivering my packets to the substation and the substation's responses back to me. The computer controlling the substation, on the other hand, may not be doing it's job of properly authenticating the commands given to it.

So... how does retaining analog copper help? At all? It's not like the power company can use that copper to manage the substation. It's not like the existence of that copper does anything to make the fact that I can ping the insecure substation from Moscow any less problematic. It's useless. What might be useful is to put critical infrastructure on separate networks, but there's no reason to use old analog technology for that. And I said "might" not "would" in that last sentence very deliberately, because it's not at all clear that the flexibility gained and money saved by using the Internet rather than a separate network isn't worth the risk. Real-world security is all about cost/benefit analyses, not because bean counters say so, but because there are real societal benefits associated with openness, alongside the risks.

It's remotely possible that a large EMP burst would take out the Internet, because modern electronics, including all of the endpoints and the routers, are extremely sensitive to EMP. In that event, having the old copper network in place might be useful, if we also have EMP-resilient devices to connect to it, meaning old-style analog telephones and telephone switches. But those are long gone. If that's the goal, we can't "keep" that infrastructure, we have to rebuild that infrastructure. And, if we're going to plow the billions into it, we'd be better served putting those billions into EMP-hardening the core routing infrastructure (luckily, most of the network is optical fiber, already EMP-oblivious, excepting the repeaters), and ensuring that critical emergency services, etc., have EMP-hardened endpoint devices.

Re:Copper is also digital

[vtcodger]

You have that backwards. The Internet was originally designed for command and control of critical (military) infrastructure.

Actually not. ARPAnet was designed to tie a few dozen facilities doing government research together using a packet switching network and allow them to communicate via a common protocol (TCP/IP). The notion that one would use a publically accessible packet switching network for military command and control would have been instantly rejected back then. (And, one would hope still would be today).

See http://www.nethistory.info/His...

Re: Copper is also digital

[rgbatduke]

Direct dial? What is this direct dial of which you speak? Next think you know, you'll be talking about cradles for old-timey phones in black bakelite and 300 baud, and I'll have to run screaming from the room before the word "teletype" is uttered...

Pardon me, my goose-quill pen is almost dry and my inkwell was emptied by a passing goat. I'll be right back.

Re:Copper is also digital

[swillden]

I stand corrected, in part. My core point, however, was that the Internet was not "designed for entertainment and casual communication". And the rest of my argument holds, that the Internet does what it does very well and is in no way "insecure".

I wonder if they realize...

[ZorinLynx]

That ever since the 80s, those copper lines simply plug into a digital phone switch anyway?

Re: I wonder if they realize...

[Anonymous Coward]

Suppose you want to have two communication infrastructures, one in use and the other for backup. We are moving towards an all-cell infrastructure. They are saying the best choice for the other infrastructure is the copper phone network -- it exists and is pervasive (unlike cable or fiber). The other choice is to build something new. If you want to have two infrastructures, why would you dismantle the one you aren't using and build a new one you aren't going to use?

Re:I wonder if they realize...

[Anonymous Coward]

How many people do you know with have a reliable, long term battery/generator system in their homes?

Re:I wonder if they realize...

[najajomo]

"That ever since the 80s, those copper lines simply plug into a digital phone switch anyway?"

And the problem isn't the Internet but the defective hardware plugged in at either end. The main problem being Microsoft Windows running on Intel hardware. 'The Mitre Corporation' are these the people that recommended Homeland security run on Windows :)

Re: I wonder if they realize...

[Anonymous Coward]

Why would you dismantle the copper phone network?

Increased profits and no-one to stop them, I'm guessing. I'm surprised the telephone network isn't federally protected in some way given its historical importance.

Re:I wonder if they realize...

[Anonymous Coward]

People can use analog systems without relying on computers. That is what is meant by a reserve control system. Full stop.

Re:I wonder if they realize...

[Anonymous Coward]

There's a huge difference between a DMS-100 switch, like I used to manage, and VoIP. The former is safe, but the latter is vulnerable. No real phone switch, while providing Internet access, can be controlled from the Internet.

Re:I wonder if they realize...

[drolli]

That was also my thought. The time that there was some electronic switch instead of an virtual packet switch are long gone, and the times that relays actually switched connections instead of computers/digital electronics which operated analog switches even longer.

And DoS attacks on such Networks are much easier than DoS on the internet.

Re:I wonder if they realize...

[Gavagai80]

Anyone with solar.

Re:I wonder if they realize...

[Woldscum]

Communications Assistance for Law Enforcement Act (CALEA)

https://en.wikipedia.org/wiki/...

The government PAID AT&T, Sprint and Verizon to upgrade the switches to IP. The FBI added Colo cabinets at the main switch sites. The FBI can wiretap directly WITHOUT interacting with the Companies. OC-12s direct in the switch matrix. No more echo cancellers or M13s. OC12 in and out of the switch to a DSC/DXC.

"In 2006 Nortel introduced the Communication Server 1500 (CS 1500) Softswitch based on VOIP to modernize the DMS based telephone switches. A CS 1500 softswitch system can replace all the DMS component modules except for the LCMs, reducing the footprint of a DMS-100 to one 19" rack and allowing operators to reduce cooling and power requirements significantly"

Re:I wonder if they realize...

[RLaager]

> allowing operators to reduce cooling and power requirements significantly

This is no joke. We replaced our DMS-10 switches with C15s. In some locations, we had to add heat to buildings that never before needed it.

Re: I wonder if they realize...

[Anonymous Coward]

Why would you dismantle the copper phone network?

Perhaps because it is (or seems to beancounters) expensive to maintain. The cables are quite old and do break and then need fixing. The thing is of course that it provides something you previously got "for free" as in you were paying for the network anyway and its resilience got taken for granted. Now, we're paying for something else, like computer networks, and don't see why we're still having to pay for "something we don't use" all that often. These people are saying the resilience we used to get for free (because the network was just that well-made) is important enough that we should keep the thing around.

Me, I think that simply saying "keep the old stuff" isn't good enough. Instead, realise that traditional telco engineering is wildly different from the computer networks techie engineering, as can be seen from comparing, say, atm and ethernet. I'm not talking about bitrates, I'm talking about the other guarantees that atm does provide and ethernet hardware expects higher layers to "fix it in software" in spite of its best efforts to thwart it. It's a mindset difference.

Computer network "engineering" is quite frequently "marginal in the best case is good enough", where telco engineering is more like "full service in the worst case and we'll reluctantly call it a day". I'm not talking telco management stupidity and incessant price gauging, I'm talking engineering mind-set. Traditionally-engineered telephone service will continue during black-outs, despite the hardware obviously needing power to do so. Modern, "converged" telephone service very likely won't, for so many reasons it's not funny any longer.

So I think that in the long run it's going to be cheaper and more functional to remember how and why the POTS was engineered like it was, and do something similar with modern technology. Perhaps as a second network for critical infrastructure, since you really should keep it separate from the other networks anyway, "converged" or not.

But do it with tech that's closer to what's being used for the other network, like glass, only with much less complexity and more hard service guarantees, like battery backups, truly geographically diversified redundant routes, easily manufacturable parts, and low-power hardware so the batteries last longer, perhaps with solar panels to power distribution points, and so on, and so forth. You can do a lot here beyond relying on century-old tech. But if that old tech truly is the best, then we'll use that. It's about functionality that the modern stuff simply doesn't provide and isn't really designed for, not clinging to times past.

Re: I wonder if they realize...

[jenningsthecat]

I just ran out of mod points, but your comment is so insightful I decided to quote it just to give it +2 visibility.

Why would you dismantle the copper phone network?

Perhaps because it is (or seems to beancounters) expensive to maintain. The cables are quite old and do break and then need fixing. The thing is of course that it provides something you previously got "for free" as in you were paying for the network anyway and its resilience got taken for granted. Now, we're paying for something else, like computer networks, and don't see why we're still having to pay for "something we don't use" all that often. These people are saying the resilience we used to get for free (because the network was just that well-made) is important enough that we should keep the thing around.

Me, I think that simply saying "keep the old stuff" isn't good enough. Instead, realise that traditional telco engineering is wildly different from the computer networks techie engineering, as can be seen from comparing, say, atm and ethernet. I'm not talking about bitrates, I'm talking about the other guarantees that atm does provide and ethernet hardware expects higher layers to "fix it in software" in spite of its best efforts to thwart it. It's a mindset difference.

Computer network "engineering" is quite frequently "marginal in the best case is good enough", where telco engineering is more like "full service in the worst case and we'll reluctantly call it a day". I'm not talking telco management stupidity and incessant price gauging, I'm talking engineering mind-set. Traditionally-engineered telephone service will continue during black-outs, despite the hardware obviously needing power to do so. Modern, "converged" telephone service very likely won't, for so many reasons it's not funny any longer.

So I think that in the long run it's going to be cheaper and more functional to remember how and why the POTS was engineered like it was, and do something similar with modern technology. Perhaps as a second network for critical infrastructure, since you really should keep it separate from the other networks anyway, "converged" or not.

But do it with tech that's closer to what's being used for the other network, like glass, only with much less complexity and more hard service guarantees, like battery backups, truly geographically diversified redundant routes, easily manufacturable parts, and low-power hardware so the batteries last longer, perhaps with solar panels to power distribution points, and so on, and so forth. You can do a lot here beyond relying on century-old tech. But if that old tech truly is the best, then we'll use that. It's about functionality that the modern stuff simply doesn't provide and isn't really designed for, not clinging to times past.

Re: I wonder if they realize...

[Anonymous Coward]

Once it's decommissioned, it's millions of dollars of high grade copper.

By project or theft, it's getting sold as scrap eventually.

Re: I wonder if they realize...

[fuzzyfuzzyfungus]

Doesn't really make their point wrong; does make them a bit too late in a lot of cases where the legacy infrastructure looks like it still exists.
Some of the old stuff should be easier to just dust off(point-to-point microwave links, say, were crushed by fiber on bandwidth; but refurbishing a limited number of transceiver stations is going to cost a lot less and be a lot faster than repairing or rebuilding the old school copper network.
The bigger issue seems like one of "and what are we going to plug into it?" Using legacy systems to cope with viruses or the like will only work if people are ready to cope with how we did things back then. If everyone just tunnels TCP/IP over whatever so that they can plug their stuff back in, you'll be just as vulnerable and a lot slower.
It's this part that I really have my doubts about: people can still organize on a small scale to do locally sensible things; but knowledge of old large-scale procedure is rather scarce; which will leave you standing around like British Airways with an IT problem if the current large-scale procedures aren't available.

Re: I wonder if they realize...

[AntronArgaiv]

Another feature of the Ma Bell POTS architecture: along with being battery powered, all the high failure parts were in the CO, where they could be easily accessed and repaired.

The terminal equipment (phones) were very, very rugged, designed to outlive their owners and function without trouble for many years. Even the touch-tone keypads still work fine after 40 years of use.

I can understand why the telcos don't want the copper infrastructure. It's not profitable for them, people are dropping wireline phone service, and DSL/T1 can't compete with cable. But we are losing a superbly designed and extremely reliable system.

Re:I wonder if they realize...

[Anonymous Coward]

How many people do you know with have a reliable, long term battery/generator system in their homes?

Anyone with solar.

Quibble, a lot of the home solar electric systems are grid-tie without battery backup. So they go down when the grid goes down.

But yeah, solar with battery backup would be a reliable, long-term solution.

Re: I wonder if they realize...

[Anonymous Coward]

TELCO had ONLY two things going for them...
1) Central battery power... so long as the bunker was up, phone was up.
2) Fastidious near universally applied operations procedures... any backwoods Tennesee tech could manage if called in to downtown LA.

Glass IS better than copper since it doesn't corrode in the hole... that part is good.
But it needs power on both ends, and design and procedures are now so distributed and fucked up... that nothing will work when SHTF.

If you only knew how many (all) cross country long haul fiber huts were backed up with less than 250 gallons of diesel onsite, and delivery "contracts" that are entirely dependant on ***electricity*** to deliver it.... you'd laugh your ass off, and then start shitting bricks.

You in your little 200 mile radius of good times, can be entirely knocked offline and thrown into lack of resources and civil chaos by grid and backhoe issues elsewhere.

Let alone targeted attacks...

Re: I wonder if they realize...

[Anonymous Coward]

I backup local, I don't need the cloud. I have 2000 vinyl LPs and CDs, I don't need Pandora.

I have books, hundreds of them, I don't need Netflix. Two hundred or so DVDs if I must.

And when the gamma ray blast from some star a kajillion miles away takes out all electronics on earth, I have a nice collection of guitars.

I'm all set for the end times, stop by the campfire, I know a bunch of songs. Oh, wait, I should get some food, too. Yeah.

Re: I wonder if they realize...

[quetwo]

The main reason why telcos don't want copper anymore is that their copper infrastructure is regulated. The Telecom Act of 1996 requires that the line owners open up the copper to competitors for a reasonable rate (reasonable is defined and calculated by the FCC). It turns out that wireless and fiber are essentially unregulated and listed as "information services" rather than as utility services. Pretty much, the phone companies don't have to share their last mile infrastructure with competitors.

Re:I wonder if they realize...

[havana9]

That ever since the 80s, those copper lines simply plug into a digital phone switch anyway?

Because in case of power failure the phone system, even ISDN is designed to continue to work on racks of 48V batteries at CO even if poer is lost ti the subscriber site. ISDN TA and PABX are designed to switch in low power/reduced mode if mains goes out. At the CO there are a couple of generator and a tank of petrol designed to power the system for two days. For this very reason mountain refuges have an UHF phone patch link with a battery backup even if there is 2G/#g or even LTE coverages in most cases. Cellphones are ok in normal times, but in emergency they tend to klock up.

Re: I wonder if they realize...

[AntronArgaiv]

The main reason why telcos don't want copper anymore is that their copper infrastructure is regulated.

I think the main reason they don't want copper, is that nobody is going to pay $60/mo for a landline phone any more. None of my coworkers have them, and I switched to a $20/mo VOIP provider. Additionally, there's not a lot you can do with copper, compared to fiber and coax. So there's not even a chance of repurposing the copper infrastructure.

So, no income from consumer phone lines, coupled with an infrastructure nobody wants, means no more copper.

Oblig

[Anonymous Coward]

Is this the best we can do? Rely on economically obsolete systems as a backup for cyberattacks?

Re:Oblig

[0100010001010011]

Mechanical offline safeties wouldn't be a bad idea for a lot of things.

Re: Oblig

[Reverend Green]

If critical infrastructure fallback systems are economically obsolete, it says a lot about the obsolescence of that economic system.

Re: Oblig

[Anonymous Coward]

You're suggesting maintaining an entire redundant system which generates negative revenue is a good idea because it might come in useful someday?

Why not spend all that extra money making the primary system robust against attack instead?

Re: Oblig

[vtcodger]

If critical infrastructure fallback systems are economically obsolete, it says a lot about the obsolescence of that economic system.

Don't disagree. But the phrase you're looking for is probably "adequacy of that economic system." The notion that maximizing efficiency/minimizing costs will produce the best of all possible worlds seems a bit suspect.

Re: Oblig

[vtcodger]

Why not spend all that extra money making the primary system robust against attack instead?

That's what we're currently trying to do. Doesn't seem to be working all that well though.

Re:Oblig

[jenningsthecat]

Is this the best we can do? Rely on economically obsolete systems as a backup for cyberattacks?

Calling it 'economically obsolete' indicates that you've fallen for the propaganda of the voodoo economists whose 'live for today / profit is king' attitudes have already fucked us over so badly. There is nothing 'economically obsolete' about having that spare tire in your trunk, (and knowing how to change a tire), because it could save your ass in some nasty circumstances. It's incredibly old-school and seems almost quaint in this era of cell phones, auto clubs, and urban sprawl - and it costs the manufacturers money, and you might be able to put the space now occupied by it to good use. But do you really want to see it disappear?

If you're thinking it's 'technically obsolete', I agree. But then, we're back to economics. And the same voodoo economists who want to rip out the POTS infrastructure because it can fatten their bottom line, aren't about to install a vast, multi-homed, hardened-hardware, no-wireless-links, redundant fibre communication network that runs independently of the Internet. That would be WAY more expensive than maintaining copper and filling the gaps that have been ripped out in digital chunks.

As usual, the bean counters will win, and everyone, including them, will eventually lose as a result, because (short-term) profit.

Re: Oblig

[Anonymous Coward]

Do they say maintain? If you left the copper in place but didn't maintain it then it would decay. But then when you need it, most of the copper would be there, and you'd "just" need to fix it. Better than having to start from scratch.

Doesn't anyone remember the plot from The Green Hills of Earth?

So, to sum up:

[LynnwoodRooster]

Cyberpunk to counter Cyber attacks!

Re:So, to sum up:

[sconeu]

STEAMPUNK!!!!

Easy

[Anonymous Coward]

Faraday cage, buried 6 feet under will protect many electronics.

What, you want to use it?

Re:Easy

[sir-gold]

If you install a fiber connection to it, and power it with a belt driven generator (driven by an electric motor sitting outside the cage), you can safely use it via remote terminal without compromising the integrity of the Faraday cage.

An EMP might take out the remote terminal and external motor, but everything inside will be fine. Since you still have a working belt-driven generator, you can use a lawnmower engine or something to drive the belt, and run your electronics even without a working power grid.

Local override

[wvmarle]

While controlled normally over the Internet, this are still pumps and other powerful motors.

As long as the power is on (either from the net or from a local backup), they can be operated manually and locally, or at least they should have that option. This way, in case of a cyber attack that somehow cripple the remote control rooms, of course we should go back to basics: send someone over who can pull the network cable, and manually press the "On" switch. The same you'd have to do if you keep old machines around (which normally also rely on electricity being available), but the difference is the need of maintaining two sets of machinery, one set of which is normally not used.

So why that second set of outdated machines? Costs a lot more to maintain than a manual override on the regular machinery.

Re:Local override

[Anonymous Coward]

That is exactly how it works with water and sewage.

Sure the IT system is fancy and very nice to have, but if all goes to hell someone just has to drive out to each station and manually start the equipment.

The problem is when electricity goes out. Normally only the most critical pump stations and treatment centres have generator power. And it will take a steady stream of trucks with diesel fuel coming in to keep it running. And I think in a crisis there will be a lot of demand for what ever diesel loaded trucks are available (hospitals, transportation etc.).

Critical infrastructure and converged IP networks

[najajomo]

'The MITRE Corporation, note that critical infrastructure is increasingly run from converged IP (Internet Protocol) based networks that are vulnerable to cyber attack'

Listen up children and I'll tell you the solution. The solution is to not run your critical infrastructure on converged IP based networks. I presume converged is a code-word for 'cloud'. And if the NSA hadn't acted to dilute security on the Internet, these networked devices wouldn't be so easy to attack.

All of this has happened before, all of this will

[crankyspice]

âoeYou'll see things here that look odd, even antiquated to modern eyes, like phones with cords, awkward manual valves, computers that, well, barely deserve the name. It was all designed to operate against an enemy who could infiltrate and disrupt even the most basic computer systems. Galactica is a reminder of a time when we were so frightened by our enemies that we literally looked backward for protection.â

Do not question Commander Adama

[goombah99]

Winter or Cylons are coming. One of those.

Re:Do not question Commander Adama

[Anonymous Coward]

It's the Solar Cylons, followed by an Internet winter. It's both.

Re: Do not question Commander Adama

[Anonymous Coward]

And that is the solution ; the battlestar galactica was going in a museum before all hell broke loose. So put this old equipment in a museum and hand it over to hobbiests to maintain like some people maintain old WW2 stuff in working order.

Just don't rely on a monoculture of systems

[guruevi]

The base of any system security is not to rely on a monoculture. If all your systems run on Windows using the same hardware, software and firmware version which the creators have long abandoned.

Require that critical systems are modifiable by the end user and can be carried from platform to platform, it's the government after all, they can set the laws and reject any contract from entities that are either too large or don't want to adhere to basic rules of security and risk management.

Re:Just don't rely on a monoculture of systems

[thegarbz]

The monoculture is unavoidable in industry unless you want to spend an exorbitant amount on service contracts and staff training. Latest trends tend towards reducing the different number of systems and the different platforms not only because of costs but also due to reliability reasons as a variety of different systems work in different ways and experts which are too thinly spread across platforms tend to make more mistakes.

Re:Just don't rely on a monoculture of systems

[jenningsthecat]

The monoculture is unavoidable in industry unless you want to spend an exorbitant amount on service contracts and staff training. Latest trends tend towards reducing the different number of systems and the different platforms not only because of costs but also due to reliability reasons as a variety of different systems work in different ways and experts which are too thinly spread across platforms tend to make more mistakes.

Pay me now, or pay me later. As usual, the cost of the 'later' option is likely to be much higher - perhaps as much as your life is worth.

Re:Just don't rely on a monoculture of systems

[Anonymous Coward]

but also due to reliability reasons as a variety of different systems work in different ways and experts which are too thinly spread across platforms tend to make more mistakes.

Design redundancy replaced with operator redundancy. I wonder how long that will last as the glorious AI era begins.

Re:Just don't rely on a monoculture of systems

[thegarbz]

You forgot the maybe. There's a incredible number of systems out there and a petty few which have actually fallen victim to attack. Why not asteroid insurance while they are at it?

Speaking of insurance, that's the bit you missed. Insurance companies pay for externally induced losses. They don't pay for expensive service contracts. Your comment just doesn't make financial sense for any company.

Re:Just don't rely on a monoculture of systems

[guruevi]

I am not talking about differing standards. If anything, we need to converge on standards while diverging on implementations. It brings both job and systems security, what is the cost of mixing too much chemicals in the water supply? Even if it's not toxic, how many millions would it cost if a particular combination accelerates corrosion?

Re:Just don't rely on a monoculture of systems

[thegarbz]

I didn't say standards. If anything most vendors follow common set of standards just with different systems. But the end result is the same with diversity comes cost.

what is the cost of mixing too much chemicals in the water supply?

Something that should not be fixed by making one system robust. This is the basis for any industrial safety - independent system. If the cost is high then there will be an independent safety system to shut things down to prevent an unsafe situation. Unfortunately "shutting down" is exactly what this article is talking about and trying to avoid.

Um No, That is Not The Solution

[LeftCoastThinker]

Um no, that is not the solution, the solution is to air gap anything you cant afford to have break due to hacking, and hunt down criminal hackers around the world. Treat state sponsored hacking like an act of war, and make sure everyone knows you will respond with devastating force.

Air gapping critical infrastructure should be a federal law, because anything connected can eventually be hacked given enough time and resources.

Re:Um No, That is Not The Solution

[Anonymous Coward]

Yep, air gapping, even away from remote login servers, completely separate and offline.

But you're still vulnerable to power, and spares.
Power goes out... no water.
Tiny fucking relay / PWM board goes out... no water.
Doesn't help that most techs wouldn't have a clue how to bypass and strap hot leads direct to a 480V motor anyway.

That's why I've got 250 gallon cubes rigged with float fill and pump to the house... somebody fucks up, I can still go get a drink.

Re:Um No, That is Not The Solution

[Gavagai80]

Treat state sponsored hacking like an act of war, and make sure everyone knows you will respond with devastating force.

Unlike a bomb, it can be very difficult to definitively establish state-sponsored hacking as responsible for an attack. You can't (or shouldn't) start a devastating war over a gut feeling.

Re:Um No, That is Not The Solution

[Anonymous Coward]

> Um no, that is not the solution, the solution is to air gap anything you cant afford to have break due to hacking,

Good so far...

> and hunt down criminal hackers around the world.

We already do that...

> Treat state sponsored hacking like an act of war, and make sure everyone knows you will respond with devastating force.

DANGER WILL ROBINSON

Here's your problem: you assume you can attribute cyber attacks. You generally cannot in the event of a competent actor (ex: a state actor). This last year showed a reasonably compelling case for a group that is THOUGHT to be associated with Russian intelligence phishing Podesta. It also showed a less compelling but still possible case for a group that is VERY PROBABBLY Russian intelligence hacking the DNC. Neither of these could be remotely proved in a court of law- no one brought a case. Instead, the media took to the airwaves to convince everyone of it, usually using the mind control phrase "the Russians hacked the election". This worked amazingly well- the biggest group that doesn't believe it is Republicans, and that's probably do to not wanting to believe a bad thing about THEIRGUY other than any actual extra amount of skepticism.

Then a couple months later we saw a giant leak showing that the CIA has an entire suite of tricks to frame other state actors for their own activity (along with a bunch of other spicy capabilities that got most of the press, such as accessing cameras for targeted systems, usually along with implication that these were all remotely exploitable things).

So would you REALLY want an "act of war" to be an absolutely unattributable, uninvestigatable action that at least one (and probably MOST of the big players worldwide) intel agency has the capabilities, prebuilt and ready to go, to falsely attribute a cyber attack of any magnitude? Especially one that, regardless of your beliefs about Russian hackers, you have to admit pretty solidly fell along party lines, and got a huge amount of people believing it was true, sans convictable evidence?

Seems fucking risky.

Re:Um No, That is Not The Solution

[thegarbz]

Um no, that is not the solution, the solution is to air gap anything you cant afford to have break due to hacking

That solution is something that you can only come up with if you have a simplistic view of exactly how these systems are built. Air gaps in many cases are not only impractical but in some cases impossible in the way modern infrastructure is run and in many cases this is the result of the general population's expectation of the infrastructure. In fact you'll probably find federal law requires the opposite of air gapping as data logging for incident investigation is often mandated in realtime and offsite.

And all of this is before you consider security principles. Air-gapping is not a security solution. Air-gapping is potentially one small element in security. Air-gapping as an end goal will result in absolute garbage security policies that aren't taken seriously throughout the organisation e.g. through complacency "it's airgapped, we're *safe*"

Worth remembering is that the Iranian centrifuges were airgapped.

Re:Um No, That is Not The Solution

[Freischutz]

Um no, that is not the solution, the solution is to air gap anything you cant afford to have break due to hacking, and hunt down criminal hackers around the world. Treat state sponsored hacking like an act of war, and make sure everyone knows you will respond with devastating force.

Air gapping critical infrastructure should be a federal law, because anything connected can eventually be hacked given enough time and resources.

You can compromise but it comes with a cost. I recently read a case study about a power outage in the Ukraine due to Russian hackers compromising the computers controlling the grid infrastructure. The Ukrainians responded to this by simply disconnecting the computers and going back to manual control, something they were able to do because their infrastructure is pretty old. It allowed them, according to the authors of that piece at least, to bring their system up much faster than what is possible with modern 'smart' grids. If you plan your system properly, make it modular/compartmentalised so that any damage done is contained to each module and attackers will have to hack multiple system modules to do real damage, put in a manual backup option, and train your personnel correctly you can enjoy the advantages of computerisation without sacrificing the security of being able to bring the thing up manually. Having said all that, hiring a dedicated security contractor to do intrusion monitoring on your computer network and air-gaping or moving everything to private networks that does not have to be publicly accessible would probably be worth every penny. The Russians don't seem to care about the damage they do. They are have hacked and jammed various air traffic control assets around the Baltic seemingly to test their jamming systems and cyber warfare capability and you can bet your bottom dollar they have done extensive research on how to bring the US power grid down.

Re:Um No, That is Not The Solution

[jenningsthecat]

... Treat state sponsored hacking like an act of war, and make sure everyone knows you will respond with devastating force.

And then devastating force is met with devastating force, and so on, until a victor emerges. But by that time the victor may only have hours to live on a planet no longer fit for life. And the victor may not even be the horse you backed...

Re:Um No, That is Not The Solution

[Anonymous Coward]

> Treat state sponsored hacking like an act of war, and make sure everyone knows you will respond with devastating force.

I assume it's fair game for all the countries that get hacked by US agencies to respond the same way?

Re:Um No, That is Not The Solution

[Immerman]

> In fact you'll probably find federal law requires the opposite of air gapping as data logging for incident investigation is often mandated in realtime and offsite.

You can get pretty frigging close to a one-way airgap. For example - if you want to prevent intrusion but log off site in real time, then airgap your facility and send your logs to an in-facility logging system which then send the data though the gap via a one-way communication channel to a second system which is connected to the internet.

Obviously you can't use a traditional bidirectional communication protocol to bridge the airgap, but you could easily build some dedicated hardware whose only "backflow" is a single asynchronous "acknowledge line" that indicates whether the last packet was received correctly. Send packet, wait maximum parsing interval, check line for error, repeat. The sender should have no hardware capable of receiving a signal from the receiver other than the acknowldege line - and can be made simple enough that the entirety of its software (no OS should be used) can be exhaustively audited to ensure that there's no way to leverage the acknowledge line to communicate anything more sophisticated. Shouldn't be hard - the error line shouldn't generate any events, and should only be accessed by one single line of code:
do { /*send packet and wait*/} while (acknowledgement_pin_value != OK);

Re:Um No, That is Not The Solution

[thegarbz]

You can, that solves *one* of the very *many* problems with cutting off systems from each other.

Your solution works well for a small chemical plant. Beyond that there are technical reasons that airgapping from public infrastructure would be cost prohibitive, and sometimes cost impossible.

Re:Um No, That is Not The Solution

[tlhIngan]

Um no, that is not the solution, the solution is to air gap anything you cant afford to have break due to hacking, and hunt down criminal hackers around the world. Treat state sponsored hacking like an act of war, and make sure everyone knows you will respond with devastating force.

Air gapping critical infrastructure should be a federal law, because anything connected can eventually be hacked given enough time and resources.

Air-gapped networks have been hacked. You might have heard of Stuxnet, which was a VERY elaborate hack of an airgapped network.

The primary problem these days is a network is no longer static. It needs to be updated - you add devices, you remove devices, and the whole system needs reconfiguration. And that opens an avenue for infecting an airgapped network.

And yes, even critical infrastructure networks get updated - pumps get replaced, controllers die and need replacement and reconfiguration, etc. Even systems get upgraded - a water pumping plant might get a new pump that needs to be managed (this happens more often than you think).

Once the airgapped network is infected, you can open a two way communications channel using all sorts of mechanisms that work through the air. Sound is one obvious one to communicate with a device on the internet (presumably already infected and listening for an airgapped computer to communicate with it).

The real problem is the world has moved beyond simplistic solutions like airgapping, and it has to take defense in depth. Air-gaps work, but only as part of a comprehensive security plan. Saying you have an airgapped network is no longer sufficient for security, just like having a firewall is no longer a miracle device to keep you safe.

Re:Um No, That is Not The Solution

[Bob the Super Hamste]

In the US if a power company loses computer control of their portion of the grid they still get the joy of rolling trucks out to substations and other locations to maintain control. An interesting thing about the Russian hack of the Ukrainian grid is that the Russians also DoSed the call center to prevent the outages from being reported sooner. Like with any number of cyber attacks there were multiple ways that this should have been stopped but wasn't. One can read all about findings either here or here for good analysis of what happened. Besides if people think a cyber attack against the power grid is the greatest threat they should consider those bastard squirrels instead. If one really wanted to do some damage discharging a high powered rifle (think .30-06 deer rifle) into some of those large transformers at substations would be easier and cause a longer outage than a cyber attack as there just aren't many spares around.

That isn't to say don't worry about cyber attacks and don't mitigate things but there are a lot of other threats that are as damaging or more so that should also be prepared for.

Re:Um No, That is Not The Solution

[Anonymous Coward]

If we follow your advice about air gapping I think we can leave the threats of death and war off the table, we won't need to drop bombs from drones on Fancy Bear.

Re:Um No, That is Not The Solution

[LeftCoastThinker]

While you are technically correct, you are citing the one in a billion moonshot (Stuxnet), which is the exception instead of the rule. As a business, if you airgap your critical infrastructure and ALSO follow best practices (that was assumed on my part, since you have infrastructure that needs to be airgapped in the first place) unless you are being targeted specifically by the NSA, CIA or other state level attackers who also have human assets in play, you are pretty safe...

Re:Um No, That is Not The Solution

[LeftCoastThinker]

Maybe in your fantasy land. In the real world, humans do not have the capability to make the entire planet uninhabitable. Stop confusing scifi with reality...

Re:Um No, That is Not The Solution

[LeftCoastThinker]

And if they try to do that to the US under Trump, $5 says they get a cruise missile up the ass (we have specific missiles that home in on Russian made jamming equipment, demonstrated during the second Iraq war). Russia prospered under the feckless Obama administration (remember the "reset button" with Hildabeast?) The Trump/Russia collusion BS is just a smokescreen for the Democrats to try and hobble the Trump administration. Trump and Putin both know they aren't allies, and Putin knows Trump is not afraid to push the button after the Syrian missile strike. Only the far lefties and the media believe the Russian collusion BS, and the way things are going, they are all going to wind up in prison for hitting people in the head with bike locks or banned from TV for posting pictures with Trump's decapitated head...

Re:Um No, That is Not The Solution

[LeftCoastThinker]

You can use a one way opto-isolator to 100% air gap your system while still transmitting data for logging and tracking purposes.

Our most important secrets and most secure computer systems are air gapped inside Faraday cages. Physical access is controlled by armed guards. That is about as secure as humanly possible at this time...

Re:Um No, That is Not The Solution

[thegarbz]

Like the other reply you've only solved one small problem out of the very large reasons that these systems are interconnected. We can't expect a modern utility to function in the modern ways we expect when the utility is geographically disperse if it is isolated.

Wrong technique

[ChrisMaple]

Going back to the days of stepper relays and carbon-granule microphones would be very expensive, even as a backup-only system. Better to design hardened infrastructure and phase it in, along with duplication and surplus capacity.

Re:Wrong technique

[Anonymous Coward]

Agreed!

Re:Critical infrastructure and converged IP networ

[speedplane]

Listen up children and I'll tell you the solution. The solution is to not run your critical infrastructure on converged IP based networks.

The problem is that almost everything today is "critical infrastructure". It's one thing to build a separate network for dams and nuclear power plants if you deem those as critical infrastructure. It's another if you deem our entire telecommunications system as critical infrastructure. Moving that to IP based systems is pretty unavoidable today.

What, comcast patented smoke signals?

[Anonymous Coward]

I call bs on copper being required once optical is widespread. And I intend to shoot gold-casing bullets, because in the future your stupid 20th century idea of market valuations mean jack shit.

Copper isn't good enough for that.

[Anonymous Coward]

Let us see to it that the Empire can still run on smoke signals, galley slaves, and Latin.

Disconnect and decentralize

[Gravis Zero]

If you want to prevent a wholesale shutdown of services by hackers then the best way to do that is to disconnect your most vital systems (water, electricity and transportation) from communications networks (the internet).

* The last reason (price) for not using solar+battery almost everywhere is fading fast and we should encourage the proliferation of isolated power systems. With the exception of exotic locations, only businesses should need to have access to the power grid.
* Depending on and funding combative nations to fuel our transportation has been foolish since day one, we need to switch to electric vehicles posthaste.
* Finally, we need to start changing our water systems into closed loop systems to conserve the water we can access to minimize external dependency because the climate is changing.

We have two choices: adapt or die.

Nothing will change until people die

[Alwin Henseler]

Air gapping critical infrastructure should be a federal law, because anything connected can eventually be hacked given enough time and resources.

At this point it should be obvious that more & more critical infrastructure will be hooked up to networks, including the internet. Even if experts consider that dumb.

Conclusion: good advice won't help, what's needed is casualties. When a cyberattack takes out large parts of the power grid, or causes a chemical plant to blow up, and people actually DIE as a result, THEN maybe air-gapping will be looked at in a different light. Until then, prepare for cyberattacks to have worse & worse real life effects.

Re:Nothing will change until people die

[Anonymous Coward]

It's not that easy either.

Let's for the sake of discussion assume that there are 3 levels of security:

1. Total air-gap. Every USB stick screened, every developer laptop in control of the IT depertment, Competent IT department that understands what the Engineers need and the mandate to dictate.

2. High security no air-gap. Competent IT department that understands what the Engineers need and the mandate to dictate.

3. Normal security practises, using decent standards and trying to comply to "best in practice" when it comes to security while giving Engineering Team what they need.

1 will cost the most both in investment and maintaining AND will make the actual equipment more expensive and the Engineer's work harder (thus more expensive). 2 will still cost a lot but would make work fairly easy on the engineers. Biggest cost here is keeping IT department staffed with competent personnel.
3. Is the base line goal, which saves a lot of money compared to the rest.

While no one wants to have a failure in critical infrastructure there will always be a balance to costs. Just like not everyone will drive a 4WD Mercedes SUV (or other safe car) without considering anything other than safety, even though no one wants to get seriously injured in a car crash.

Not saying that you are wrong in the fact that the cyber attacks will affect society more and more though. Just pointing out that "not maximum" security sometimes is a sound choice.

Re:Nothing will change until people die

[Anonymous Coward]

When a cyberattack takes out large parts of the power grid, or causes a chemical plant to blow up, and people actually DIE as a result, THEN maybe air-gapping will be looked at in a different light.

pigeons and squirrels are much more likely to cause major blackouts, what is your solution here?

motor vehicles crashing into utility poles can wipe out all of your connectivity and power at once, how do you solve this problem?

hackers are a minor nuisance compared to squirrels and drunk drivers

Re:Nothing will change until people die

[Anonymous Coward]

> 1. Total air-gap. Every USB stick screened, every developer laptop in control of the IT department, Competent IT department that understands what the Engineers need and the mandate to dictate.

Euuuuuh, no! People like you are part of the problem! If you have an air-gapped network, you need a dedicated station to manage servers on said air-gapped network. Preferably one which never leaves the premises.

Re:Nothing will change until people die

[Anonymous Coward]

Reports should be printed. USB sticks should be avoided at all cost except when absolutely necessary (i.e.: critical software upgrade) . Even though, the machine which downloads the software upgrade (assuming it's from a website) should be a well patched, dedicated machine that does nothing else.

Re:Nothing will change until people die

[Anonymous Coward]

No engineers allowed to leave the premises. Perimeter guard shoots on sight.

Re:Nothing will change until people die

[wyHunter]

It won't change then, either.

This approach has no life

[Vadim Makarov]

Legacy systems will quickly become obsolete, as their stagnating performance will make them useless for future computing and communication tasks. Sure you can have a working 300 baud modem, but what would you do with it on today's internet and industrial control systems? Servers will probably time out trying to deliver a web page through it. In the world where Moore's law reigns, retiring older technologies only makes sense.

Re:This approach has no life

[Anonymous Coward]

I still manage a bunch of 300 baud, and even a few 110 baud, modems in point of sale systems that also process credit cards. When you can't get reliable Internet access and have to use POTS lines that call long distance so the short training times and quick connect are more important than bandwidth, you use what just works. Most of our modems are 56k USR Couriers, but we still use "S37=3" to limit it to 300 baud since it is faster to connect. Living in the Seattle area sucks since we have to resort to using 300 baud modems like it's 1990.

Re: This approach has no life

[Anonymous Coward]

I've found that S37=5 isn't any slower to connect. That is 1,200bps.

Re:This approach has no life

[Anonymous Coward]

Sure you can have a working 300 baud modem, but what would you do with it on today's internet and industrial control systems?

you can run the gas and electric meter readings from a whole block of buildings through a single 300 baud modem and there would be no bottlenecks at all

you can throw in fire and flood sensors for free

Re:This approach has no life

[Anonymous Coward]

300 Baud is plenty, stop thinking in your silly webpage based mind. Most industrial equipment still has RS232 or 485 ports. Those don't crap out in case of some noise, are easy to galvanic isolate, and they can run a few tens of meters without concerns. Additionally you don't need fancy drivers or specific hardware/software for it. Another thing still popping up frequently is GPIB/HPIB, same reason really: it's robust and reliable. Industry doesn't care about your silly web 2.0, we want things to work and keep working.

Re:This approach has no life

[kenwd0elq]

"Servers will probably time out trying to deliver a web page through it."

There's your problem right there. "Web pages" are inherently full of fluff. You don't need pictures to run control systems; you could do it all in plain text, or even XML, and 300 baud would be "fast enough" for most purposes.

Re:This approach has no life

[Miamicanes]

> 300 Baud is plenty, stop thinking in your silly webpage

That might have been true for credit card terminals prior to chip verification (that basically just had to dial in, confirm that the card number, expiration date, and (maybe) CVV was legit, and get confirmation that the transaction was likely to be approved... but with NEW cards that have a chip for authentication, a 300-baud CC terminal will take upwards of TWENTY SECONDS to complete a single transaction due to all the handshaking and (relatively) large blocksize required for robust encryption. Twenty seconds doesn't sound like a lot, but for a business that has multiple customers in line at any moment in time (say, McDonalds or a grocery store), adding that much time to every transaction would be crippling. McDonalds (just to name one company) has spent literally MILLIONS to make sure that the total time from "swipe" to "thank you, here's your receipt" is never longer than 5 seconds.

Re:This approach has no life

[vtcodger]

nit-picking I know. But the specified length limit for RS-232 is 50ft=15m. You can usually get away with pushing that a little. But back in the day I really did run into occasional problems with data quality on long cable runs. I wasn't a big fan of RS232 BTW -- too many legal, incompatible, configuration options.

Re:This approach has no life

[someoneOtherThanMe]

or even XML, and 300 baud would be "fast enough" for most purposes.

Not even close. For a relevant example, in the XML-based OpenADR standard (demand-response, i.e. control of electrical loads such as heating) the "oadrDistributeEvent" message (essentially the command "you water heater, turn off now") is a few kilobytes, or over a minute at 300 bps. The response oadrCreatedEvent (ie.e ack) is over a kilobyte.

Re:This approach has no life

[Vadim Makarov]

That's a good points. The next thing will be post-quantum crypto, and will probably need to exchange data of significant size, even if everything else is made efficient.

Re:This approach has no life

[Anonymous Coward]

Whow, just, whow.

What do you really need for a control system for a valve.

Total message size: 512 bits = 65 bytes. If you want to use encapsulate this in a IP packet, many of these fields could be mapped to values in a IPv6 header.
* An identifier for the valve, maybe a 128 bit UUID.
* A command: 1 byte (write, read)
* The setting of the valve, maybe a 64 bit integer, with UINT64_MAX being fully open, and 0 being fully closed.
* Maybe a 64 bit sequence number/timestamp, 256 bit sha, for authentication purposes.

Re:This approach has no life

[Anonymous Coward]

lol I didn't know or realize that, that the swipe cards were so limited and thus that the modem transaction is extremely limited itself.
So, 1200 baud might be "the" standard speed for chip cards? In my country we got chip cards early rather than building a lot of infrastructure and business on swipe cards. When paying there's clever staging so it doesn't feel too long. Set up time, then "insert card" immediately followed by "enter code", then the chip itself has authority to say if your code was good or bad, then a little bit of closing time I guess, if the code was good.

Re:This approach has no life

[silas_moeckel]

We needed drivers then we need drivers now, Normal PC serial ports just got cloned extensively so that they all need the same driver and it's built in. USB should be similar serial is a well-defined thing and should be baseline (on anything but Windows).

Overall it's a poor premise, we need to ensure these are not overlay networks but running modern air-gapped networks is far better than some ancient tech as far as outside the building.

Re:This approach has no life

[Anonymous Coward]

nit-picking I know. But the specified length limit for RS-232 is 50ft=15m. You can usually get away with pushing that a little. But back in the day I really did run into occasional problems with data quality on long cable runs. I wasn't a big fan of RS232 BTW -- too many legal, incompatible, configuration options.

RS-232 has often been used over much longer lengths for Modbus communications but industrial equipment runs at high voltages than PCs do.

Re:This approach has no life

[operagost]

Now, what was my Compuserve ID again?

Re:This approach has no life

[operagost]

Can we use MNP 5 on a 300 bps connection?

Re:This approach has no life

[Anonymous Coward]

or even XML, and 300 baud would be "fast enough" for most purposes.

Not even close. For a relevant example, in the XML-based OpenADR standard (demand-response, i.e. control of electrical loads such as heating) the "oadrDistributeEvent" message (essentially the command "you water heater, turn off now") is a few kilobytes, or over a minute at 300 bps. The response oadrCreatedEvent (ie.e ack) is over a kilobyte.

Which is "Good Enough" for a disaster recovery situation as that is infinitely faster than sending someone out to the location to do the work.

Re:This approach has no life

[Anonymous Coward]

Credit cards transactions are hardly critical... It's an inconvenience if it doesn't work but it has no effect on safety. Critical: Industrial control systems, etc.

Re:This approach has no life

[Anonymous Coward]

RS232 is for local use, 485 for distances upto 1 km.

Steampunk Copper Pipe Dreams

[bill_mcgonigle]

Our society cannot function on steampunk technology - if it did it would be a different society, no matter how alluring the aesthetic.

Re:Steampunk Copper Pipe Dreams

[93 Escort Wagon]

Our society cannot function on steampunk technology - if it did it would be a different society, no matter how alluring the aesthetic.

One thing's for sure - there'd be a lot more supervillians around.

Re:Steampunk Copper Pipe Dreams

[operagost]

And soot. So much soot.

BETTER PLAN (in Trump's ear...)

[Anonymous Coward]

NUKE EM NOW!

Damn you, Hackers

[Powercntrl]

I remember watching Hackers for the first time back in the mid '90s, and my suspension of disbelief couldn't get past all the things depicted as being hooked up to the internet. Apparently, some other fuckers were watching it, and thinking it was a great idea.

Mark my words, Hollywood probably got killer robots right too - they're just wrong on the date.

Re:Damn you, Hackers

[Anonymous Coward]

Right after the intro, there's a scene where Dade Murphy uses social engineering to gain access to a modem line through which he can access a TV station's network and use the tape robot to change the program. You just assume that things were "connected to the internet" in that movie, but Hackers actually showed the 90s version of hooking everything up to the internet, and that was outside reachable modem lines without any security. By the 90s, that had been around long enough to be cliche. Remember the movie Wargames from the 80s? Where the protagonist just has his computer dial long lists of numbers to find modem lines? The name for doing that comes from that movie: It's called "war dialing".

Is that English?

[Bartles]

Seriously. I didn't know telecommunications networks use pneumatic pumps used to pump water. What function could they possibly have in a telecommunication network? Oh... Pneumatic pumps pump water as a hedge against global disruption resulting from a cyber attack on critical infrastructure. Pumps. What can't they do?

Re:Is that English?

[Anonymous Coward]

In certain places there is a network of pneumatic tubes around 3 inch diameter going from building to building. They where used to pass paper messages, money or other small items inside a small cylinder (slightly smaller diameter and about s foot long) through the pipe to another building.

A few weeks ago I noticed a super market had just installed a system like that back in to get the money from the cash register into the office.

Perhaps I'm not human...

[Anonymous Coward]

"And humans have yet to design a digital system that cannot be compromised"

My network connected digital systems have been attacked by paid for black hats on several occasions and not a single one has been able to hack, crack or otherwise thwart my security.

So perhaps I'm not human....

Perhaps those companies out there need to spend some money on security and people who know security, perhaps then they would have systems that were safe but of course we all know security costs money which is why so many of these systems are breakable.

Re:Perhaps I'm not human...

[OrangeTide]

It depends mostly on the complexity. If I designed a toaster oven firmware you wouldn't be able to find someone who could hack it. Because I'd do formal verification and prove it to be correct, and it would be easy to do so since it is a simple system. But if you have a heterogeneous networked environment, then designing for security quickly spirals out of control. It's theoretically possible to create an unhackable system in a complex environment, but it may actually be impossible to prove it to be secure, which is kind of the point.

Re:Perhaps I'm not human...

[thinkwaitfast]

What if you made a mistake in your proof and your formal verification is incorrect?

Re:Perhaps I'm not human...

[Anonymous Coward]

Sounds like you've done a good job, but the claim that a system "cannot be compromised" is a claim that can never be proved, only disproved.
"Compromised" can mean a lot of things. Are you invulnerable to a social engineering hack for example? What if someone covertly gained physical access to your systems?

Re:Perhaps I'm not human...

[Anonymous Coward]

It depends mostly on the complexity. If I designed a toaster oven firmware you wouldn't be able to find someone who could hack it.

Until someone downloads the firmware, changes MAX_TEMP to 5000C and installs their firmware "update"
Then prepare for inferno!

Re:Perhaps I'm not human...

[OrangeTide]

Then your house burns down, sorry.

Re:Perhaps I'm not human...

[OrangeTide]

The system is secure as long as you don't have physical access to my toaster.

Obviously you can plug it into the wrong voltage (110? 220?), or stuff it full of newspapers and cause all sorts of havoc.
And the manufacture may have built it out of spec, and left out the water sensor that prevents you from killing yourself with a toaster in the bathtub.

Re:All of this has happened before, all of this wi

[Anonymous Coward]

Are you trying to say that Cylones stole the election from Bernie, anointed the Hilldog, and killed Seth Rich to cover it up? Then still lost due to Wikileaks/Trump anyway, and therefore tried to blame it on the Fake Russia Hack story?

Interesting theory, and actually more plausible compared to what the MSM is putting out now.

One good EMP later....

[Wizardess]

One good EMP will take down the copper connections quite nicely. But, then, the power to make the controls driven by the copper connections work will be as gone as that for the FIOS or other connections.

{^_^}

Business Theft

[kenwd0elq]

Telcos have been actively pushing residential customers off of copper wire and onto VOIP, and making ENORMOUS savings on their costs - but continuing to charge the rates that used to pay for copper landlines. The only savings to the customer is free long-distance, which costs practically nothing for the telcos to provide.

And yet, when the power goes out, so does my VOIP phone line, provided by the local telephone company. I've got a UPS to power the phone router, but apparently there isn't one at the telco switch. So when power goes out, so do the "landline" phones, AND the cell system (which is ALSO powered by the electric utility).

I really ought to buy a new HAM radio, since I used to be an ARES operator. Because in a widespread power outage. that might be the only communications link.

Re:Business Theft

[thegarbz]

but apparently there isn't one at the telco switch

A problem which has nothing to do with copper vs VoIP, and everything to do with a stupid telco provider.

Re:Business Theft

[ledow]

Let's be honest.

In any extended power outage (let's say a week or more), pretty much communication is going to be the least of your worries in most places.

No power = dangerous roads (lighting) + no fuel (pumps) + no shops (payments, refrigeration, etc.) + no medical (hospital power, etc.) + no mass media (emergency broadcasts, etc.)

Although you certainly would appreciate a way to talk to others, there's not going to be an awful lot that anyone could do unless they were power-independent too, and they're unlikely to be able to do much.

Any extended power outage will be akin to just going back to pre-electrical times and no amount of solar panels are going to help the big infrastructure.

The solution, as pointed out by others, is to make those people invest in the proper infrastructure. In the same way that copper telephony stayed up because of things like batteries in street cabinets, and independent power in local exchanges, the only way for the modern stuff to stay up is exactly the same kinds of kit.

And though you might put things on a UPS (which is NOT a solution past a handful of hours of outage), your ham kit will suffer the same problem too. Sure, you can battery power it for a while. Maybe longer than a phone line. But eventually it will still fail too.

Re:Business Theft

[Anonymous Coward]

Your telco doesn't have a UPS to cover even a few hours of power outage? You need some new laws!

Re:Business Theft

[drinkypoo]

And though you might put things on a UPS (which is NOT a solution past a handful of hours of outage), your ham kit will suffer the same problem too. Sure, you can battery power it for a while. Maybe longer than a phone line. But eventually it will still fail too.

Yeah, but you can run your HAM radio off a pedal-powered generator, or a rinky dink harbor freight solar panel.

Re:Business Theft

[Shatrat]

There is definitely a battery backup at the telco CO. If your service goes down when you have power issues in your area, it is more likely you are being served by a small cabinet or pole-mounted DSLAM which does not have a backup battery string or generator.

Digital systems without known compromises

[Anonymous Coward]

IBM 704 and IBM 1401 - both are decimal/BCD systems able to operate on variable length values. Suitable for accurate financial calculations and about 60 years old. The transistor-diode logic in the 1401 tends to be pretty robust but very inefficient for power.

The same can't be said about z/OS based systems and it's predecessors (OS/390 and MVS). There have been known vulns in these otherwise super reliable mainframe systems. All those i-series, S/390, S/370 and S/360 systems that we use in critical systems are not necessarily as hacker-proof as we've assumed for the last five decades.

hah

[Anonymous Coward]

It will never happen,at least not in USA, who would pay the costs ?
Certainly not the com's firms,unless they get government grants to do so.
Utility owners won't,cos it costs,so same problem,money..
Lots of those now connected systems should never have been connected to anything more complex than an old analogue phone !!

One Word: Bananas

[Anonymous Coward]

Ape shit (especially flung)
Putin (and cronies)
Trump (all things)
Republican (nearly all)
Fox News (excluding Smith/Cavuto)
Alt-right things (need I say more)

"Critical" means "urban"

[rho]

In this case, "critical" means "urban."

Densely populated cities rely quite a bit on automation, facilitated by modern communication networks. Urban areas have a high population density. They are designated critical because they have more people per square mile than Billings, Montana.

If you live in NYC or LA, please explain why Billings, MT should care if you drown in your own sewage because your WiFi is down.

Re:"Critical" means "urban"

[jeff4747]

Because Billings, MT receives a lot of money from NYC and LA.

In the US, urban areas subsidize rural areas.

Re:"Critical" means "urban"

[rho]

That is hilariously untrue, unless you think you can eat money.

Re:"Critical" means "urban"

[jeff4747]

That is hilariously untrue, unless you think you can eat money.

Are you under the impression that rural areas buy all the food grown in rural areas?

Again, rural areas get money from urban areas. Both via government spending and the customers for what those rural areas produce.

Re:"Critical" means "urban"

[Anonymous Coward]

Rural areas actually produce physical objects that are quite useful, namely food. The wealth of a nation first comes from the ability for that nation to feed itself. Food has real value, always will.

Urban areas can't exist without rural areas to grow food.

Rural living is the default condition for humans, it's what we evolved in.

Re:"Critical" means "urban"

[jeff4747]

Rural living is the default condition for humans, it's what we evolved in.

No, we evolved in small hunter-gatherer tribes.

Then we figured out banding together and specialization resulted in higher output and towns and cities were formed.

Those towns and cities were surrounded by rural areas that sold food to the people in the cities.

Rural areas actually produce physical objects that are quite useful, namely food.

And that still doesn't change that rural areas get their money from urban areas.

Re:

[Anonymous Coward]

A corrupt capitalist government would allow the most clout to do work on a new infrastructure, even if it wasn't used, it is an easy way to make money, despite the government mandated 5x9s reliability on old Plain Old Telephone Service (POTS). Hopefully 911 doesn't switch completely away... it is best to not receive "Can you hear me now?" when calling 911.

Soo...

[JustNiz]

If we're going to add in the additional cost of preserving and maintaining the old systems that the new systems replaced, isn't it better to just use the old systems and save money by totally ditching the new ones?

PPIP: Pneumatic Plumbing Internet Protocol

[Anonymous Coward]

Cool... just like in that Monty Python's movie "Brazil". Give a new meaning (or rather, very old one) to "data packets".

Re:My perspective... (from 300km high orbit)

[Anonymous Coward]

> My perspective... (Score:-1, Troll)

(S)he is not a troll, (s)he is likely an astronaut or cosmonaut writing from the ISS. For manned space vehicles, potable water is created by filtering the crew's urine because there is no other available source.

Pneumatic Control FTW

[stereoroid]

Years ago, in my first job, I worked in a steel factory on control systems. They had a "gas plant" heated coal to extract coal gas for use elsewhere in the factory, which was a potentially hazardous environment, to put it politely. Despite the fire risk from the gas, they had to have electronic CO sensors for safety and to measure the gas quality, but those were designed to be safe in that environment. Beyond that, there were no electronics in the plant, nothing that could cause a spark. The control systems for the plant itself were all pneumatic, and were pretty amazing in retrospect. I'm talking full proportional (PID) control, not just on-off switching. You had pneumatic actuators which were like pneumatic transistors: a tiny pressure controlling a hefty valve that controlled large gas flows precisely.

Re:Pneumatic Control FTW

[Anonymous Coward]

Years ago, in my first job, I worked in a steel factory on control systems. They had a "gas plant" heated coal to extract coal gas for use elsewhere in the factory, which was a potentially hazardous environment, to put it politely. Despite the fire risk from the gas, they had to have electronic CO sensors for safety and to measure the gas quality, but those were designed to be safe in that environment. Beyond that, there were no electronics in the plant, nothing that could cause a spark. The control systems for the plant itself were all pneumatic, and were pretty amazing in retrospect. I'm talking full proportional (PID) control, not just on-off switching. You had pneumatic actuators which were like pneumatic transistors: a tiny pressure controlling a hefty valve that controlled large gas flows precisely.

We've been getting rid of those everywhere else for a long time, nuclear is about the only place you'll still find some pneumatic control loops due to radiation-hardening requirements. Meanwhile oil refineries and chemical plants moved to electronic systems with non-incendive wiring, explosion-proof housings, and using intrinsically-safe circuits in flammable atmospheres. The only pneumatic parts left are the air supply to the control valve actuators, the positioners themselves are electronic.

Nobody knows about data diodes?

[ka9dgx]

There's a thing, called a data diode... you have wild open internet on one side, and a safe network on the other.... data can only EXIT to the internet, and never enter... protected by the laws of physics themselves. You can monitor all you want, but never control, from the internet. These are the types of things we need to allow remote monitoring of stuff.

Yes, truly redundant systems should be kept in place... the FAA is phasing out a ton of VOR stations... but at least they've had the sense to keep a minimal network around (directly contradicting what I thought a few minute of googling ago).

Isn't that why we still have copper?

[sabbede]

I thought the DoD insisted that we keep the copper infrastructure in place as a fallback. Is that imperilled? Is that why they wanted MITRE (who work for them) to publish this?

Re: Critical infrastructure and converged IP netwo

[Anonymous Coward]

Converged in this context means the only protocol is IP. No ATM, IPX, GSM or custom management protocol. Just IP for all traffic. Probably not even with separate management interfaces - just a vlan.

Therac-25

[jbmartin6]

I expect we will see more and more of the approach taken by some medical devices, where the software (vulnerable) controls are limited by analog failsafes in the machinery. Due in part to the Therac-25 incident. "Just airgap it" is an inadequate solution in many cases, or even more expensive than maintaining analog backups.

too little, too late

[Anonymous Coward]

If it was frozen right now, it wouldn't be sufficient, and they can't walk backwards.

This was intended as propaganda, but there is truth behind it. There is some degree of fear, because there is a potential risk, a threat with some level of viability.

They didn't grow up in the 60's or 80's. They were alive, and their brains were operating at some primitive level, but they didn't grok the input, and they didn't grok the required response. They didn't get it then, and don't get it now.

If they wanted to, they could go look at Mosul. What is "quality of life" there? Does copper tubes and pneumatics do those folks much good? There are more fundamental fundamentals than does the grocery store door open. A truly heterogenous architecture, a diversified portfolio, is resistant to a single breed of disturbance or load. Copper is too simple.

Re: Critical infrastructure and converged IP netwo

[Anonymous Coward]

http://www.excitingip.com/743/network-convergence/

Guess I'll keep my 56k modem?

[p51d007]

I'd just have to relearn how to set IRQ's, comm ports, AT commands...but I'd get the joy of hearing that modem sound again.

Re:Guess I'll keep my 56k modem?

[Anonymous Coward]

tip -9600 /dev/cua/a
connected
AT
AT&F
ATDT (phonenumber)

I think I just threw out my USRobotics mega-manual with all that stuff. Above is all I remember OTTOMH, with some bonus old tip commands.
The audible connect, ah yes. It got to the point where you could determine what speed you would get, and possibly other problems, just by the way those beeps and boops sounded, or didn't sound.

Then design it

[Anonymous Coward]

... isolated from the internet and other general purpose networks ...

So there are 2 options:

1) Harden general purpose networks physically and service-wise with generators and redundant paths.

2) Create a parallel network for government, water, electricity, rail, flight and emergency services. To truly "hedge against the growing threat of global disruption", it'll have to be hardened, as described in option 1.

... have yet to design a digital system ...

No-one's claimed it is impossible, so this is a failure to build the required the "digital system": Yay, capitalism.

Remember, the main reason for copper POTS being so reliable, was legislation. In the USA, mobile data services have little legislation so it is not surprising that "civilization-sustaining functions now susceptible to attack".

So, MAD has been replaced

[Anonymous Coward]

by Mutual Assured Hacking.

Re:Critical infrastructure and converged IP networ

[Anonymous Coward]

And definitely don't plug everything into a social media virtual world.

If the issue is security...

[Anonymous Coward]

It is important to keep in mind - humans have yet to design an analog system that cannot be compromised.

Quick! Get me

[jpellino]

Kevin Costner and Jeanne Tripplehorn, on the double!

We also need another Internet ...

[CaptainDork]

... because the current one is trashed out.

Once business got their fucking tentacles snaking across the infrastructure, shit went downhill.

Tor is a failed attempt, but it's a good try.

worse yet

[frisc]

the worst crime is converting nuke power plants from electro mechanical protective relays to easily hackable microprocessor based electronic relays like the GE Multilins. I installed Multilins in a missile defense power plant and had to call the FBI with a warning "do not connect Multilins to the internet". The stupid military didn't care.. Caveat emptor.

seems every time copper is declared obsolete

[Anonymous Coward]

someone finds a faster, better way to cram signals and power down it.

aside from those companies making significant money recycling the copper they pull from buildings during renovation, and of course sellers of new fiber hardware, who benefits from tearing out a few lines that aren't in anyone's way?

too late for the analog phone system

[swschrad]

existing equipment is basically being kept alive by cannibalizing the unused machines installed in the 1990s for spare cards. there are no analog phones being made any more, it's all chip on board stuff, the 5xx series type of phones are almost 40 years past production.

Or we could, you know, make things secure.

[Anonymous Coward]

Invest money in maintaining old infrastructure, or invest money in security? Hmm, hard choice.