As someone who used to deal with SCADA systems all the time, I shudder whenever I hear the words "security" and "SCADA" in the same sentence.
Back in the bad old days - when SCADA was driven by OPC - you had to turn off security just to get things like DCOM to work properly. It was scary and wrong, but you had very little choice. Talking to friends in the industry it doesn't seem to have gotten any better.
The real problem stems from engineering departments losing political clout within business that are primarily engineering concerns. The rise of the IT department, with its alignment closer to the management end of things (as opposed to the end that does the work) meant that engineers had to compromise their networks to fit in with corporate policy.. hence we end up with SCADA systems on the corporate network and other such craziness.
Once I was working in a factory as a consultant and I noticed a set of blue cables running behind I beams. I made a mention about them and next thing the head engineer whisked me around the corner, told me to be quiet.. and the explained that that was the engineers "own" network.. one they had to run to keep the factory going and that they would appreciate it if I kept my mouth shut in future.
That kind of madness is why we're where we are now, with far too much critical infrastructure available over the internet. And I would heartily recommend the model that was presented to me.. keep it on its own network.. and don't tell anyone from IT.
Hear hear!
To my mind, they still have to prove themselves.. but it's (another) step in the right direction.
Welcome to the party Microsoft - glad you could make it.
Slashdot Mirror
As someone who used to deal with SCADA systems all the time, I shudder whenever I hear the words "security" and "SCADA" in the same sentence.
Back in the bad old days - when SCADA was driven by OPC - you had to turn off security just to get things like DCOM to work properly. It was scary and wrong, but you had very little choice. Talking to friends in the industry it doesn't seem to have gotten any better.
The real problem stems from engineering departments losing political clout within business that are primarily engineering concerns. The rise of the IT department, with its alignment closer to the management end of things (as opposed to the end that does the work) meant that engineers had to compromise their networks to fit in with corporate policy.. hence we end up with SCADA systems on the corporate network and other such craziness.
Once I was working in a factory as a consultant and I noticed a set of blue cables running behind I beams. I made a mention about them and next thing the head engineer whisked me around the corner, told me to be quiet.. and the explained that that was the engineers "own" network.. one they had to run to keep the factory going and that they would appreciate it if I kept my mouth shut in future.
That kind of madness is why we're where we are now, with far too much critical infrastructure available over the internet. And I would heartily recommend the model that was presented to me.. keep it on its own network.. and don't tell anyone from IT.
Hear hear! To my mind, they still have to prove themselves.. but it's (another) step in the right direction. Welcome to the party Microsoft - glad you could make it.