The big picture: rules are broken all the time.
If you take a gander at the disclaimer at the bottom of this page, I’ve promised my bosses here at eWeek that I will under no circumstances use Security Watch as a platform to trumpet the work of my formal employer, Core Security Technologies.
However, the Web is already abuzz with a number of stories about a piece of research that came out of our CoreLabs group today that touches on a very interesting and critical issue that very much merits mentioning in a broader sense — that being the security of Supervisory Control And Data Acquisition systems, or SCADA software — the technologies that manage electronic operations at places like power plants, water treatment systems, mines and chemical manufacturing facilities.
Today’s research highlights a vulnerability in SCADA software made by an Australian company, Citect, that is used for just such purposes. Aside from the threat of an attack launched internally by an employee at a company using such software — something that has already happened in the power industry right here in the U.S. — the big issue that is being highlighted in the research is that companies are integrating their SCADA networks with other systems that are Net-connected, thereby making it possible for a remote attack on a power plant or water system.
Scared yet? As I noted in yesterday’s post, this is exactly the type of worst-case scenario referenced by former White House terrorism advisor and IT security expert Richard Clarke in his fictional novel “Breakpoint,” published in 2007. It reads sort of like Tom Clancy “light” but the premise is very intriguing.
The central idea is that someone smart enough to carry out such an attack could conceivably use such a vulnerability to carry out an attack that blows up a power plant or poisons a water system from anywhere in the world.
Some theorists already maintain that the major Northeast U.S. power outage of five years ago was linked to just such an attack. Researchers have already directly linked other cyber-attack activity to foreign governments and terrorist groups.
And there’s already a burgeoning market for companies to address SCADA security, as in the case of startup Industrial Defender.
As a result of all this, SCADA security is going to go under the microscope as never before and become a big issue in the coming months and years, and that’s a good thing for everyone.
Citect’s advice to users of its software is pretty simple — and consistent with that offered by other providers in the space — companies employing these SCADA technologies should be keeping them totally isolated from public networks, or employing serious security tools to keep them from being exploited.
Just like retailers’ stores of electronic customer data, right? And we all know how badly that’s gone.
I’ll have to apologize for setting some rules for this blog and then immediately blurring them. Let’s all hope that the organizations running these SCADA technologies are being far more adherent to the rules of the day for keeping their operations protected.
Matt Hines has been following the IT industry for over a decade as a reporter and blogger, and has been specifically focused on the security space since 2003, including a previous stint writing for eWeek and contributing to the Security Watch blog. Hines is currently employed as marketing communications manager at Core Security Technologies, a Boston-based maker of security testing software. The views expressed herein do not necessarily represent the views of Core Security, and neither the company, nor its products and services will be actively discussed in the blog. Please send news, research or tips to SecurityWatchBlog@gmail.com.
