Vendors must develop industry-specific security software with critical infrastructure sectors, said Scott Borg, director and chief economist at the U.S. Cyber Consequences Unit. Currently, each sector has three or four software suppliers that everyone uses, he said. The same or similar products are used to protect oil refineries, hospitals, power grids and other facilities — all with different equipment and weaknesses. “No wonder we’ve got vulnerabilities,” Borg said.
Industrial control systems are the nervous system of critical infrastructure. They connect networks of sensors that read data, relay commands and send alerts when something goes wrong. The systems manage production and distribution of products and enforce safety procedures. Supervisory control and data acquisition systems and process control systems are two common types of control systems. SCADA systems place their computing power in the field and use radio and Internet connections to control many devices over a broad geographic area, often hundreds of miles. Process control systems centralize information technology in an operator’s console and offer real-time control of everything in a small geographic area or one facility. Facilities often have both kinds of systems in place.
SCADA and other control systems don’t have direct connections to the Internet, but malicious hackers can access them through facilities’ corporate networks that do connect to the Internet. The systems have little built-in security and are easy pickings. The electronic control systems that act as the nervous system for all critical infrastructures are insecure and pose disastrous risks to national security, cybersecurity experts warn. Average hackers can break into the systems, said Robert Graham, chief scientist at Internet Security Systems (ISS).
Attacks are rare because control systems are still complex and individualized enough to make cracking them difficult, although a hacker who knows a particular system well can break into it easily, said Jason Larson, senior cybersecurity researcher at the Idaho National Laboratory, which leads federal efforts into critical infrastructure cybersecurity. Even if a facility has not been attacked, that doesn’t mean it’s secure or the threat isn’t real, said Michael Assante, senior manager of critical infrastructure protection at the laboratory.
For example, during negotiations to provide penetration testing to a critical infrastructure facility, the facility’s operators confidently told an ISS team they didn’t need help because their control system was already secure.
http://www.fcw.com/article94273-05-08-06-Print