stuxnet

This Blog Has Migrated to Industrial Security at Belden.com

With the last post from Eric and Joann Byres below, this blog is now closed.  However, Belden continues to publish ICS security articles at the Industrial Security blog on Belden.com

Farewell from Tofino Security Founders Eric and Joann Byres

This blog is the last one from me as a member of the company that manufactures and sells Tofino Security products. Joann Byres (Tofino co-founder and Belden Vice President) and I are retiring from the Tofino Security group at Belden effective January 30, 2015.

Dragonfly Malware Targets ICS Systems

The age of malware specifically targeting industrial control systems (ICS) began in 2010 when Stuxnet was revealed to be disrupting operations at one of Iran’s nuclear enrichment facilities. Since that shock, we have seen advanced malware, such as Flame and Duqu, target energy companies for espionage purposes.

SCADA and ICS Cyber Security: Facing the Facts

Our last blog, contributed by Thomas Nuth, highlighted the fact that industrial cyber security is now being discussed by heads of state within the international community - the Executive Order – Improving Critical Infrastructure Cybersecurity signed by President Obama in February of this year being just one indication of the importance being attached to th

Making Patching Work for SCADA and ICS Security

If you have read my previous blogs on patching for control system security, you might think I am completely against patching. Guess what? I’m not against them!

Patching for SCADA and ICS Security: The Good, the Bad and the Ugly

In my last blog, I discussed the reasons why critical industrial infrastructure control systems are so vulnerable to attacks from security researchers and hackers, and explained why patching for such systems is not a workable solution.

SCADA Security: Welcome to the Patching Treadmill

As regular readers of this blog know, after Stuxnet, security researchers and hackers on the prowl for new targets to exploit shifted their efforts to critical industrial infrastructure.

Unfortunately, the Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) applications they are now focusing on are sitting ducks.

SCADA Security: Phishing Season is Open

Last week I received am email (shown further down on this page) purporting to be from the US Internal Revenue Service (IRS).

SCADA Security Directions 2013

January is the Cruelest Month

2012 SCADA Security Predictions - How Did Eric Byres Do?

Early in 2012 Eric Byres wrote a blog article predicting what he thought would happen in 2012 with regards to SCADA and ICS security. I went back to his blog and highlighted the four main predictions he made. Then I asked him to rate himself on each one.

Major Manufacturer Admits PLC Security Breach

Editor's Note

3rd Annual Controls Engineer Holiday Gift Suggestion

Last year Eric’s holiday gift suggestion got his culinary juices flowing with the idea of a sous-vide oven; or for the true controls engineer, the plans to build your own. He was pleasantly surprised a few weeks later, when a sous-vide oven arrived under the tree.

Making SCADA Security Simple with the Schneider ConneXium Tofino Firewall

“Lacking extravagant IT budgets, automation systems also require cyber security systems that just work, with a minimum of human intervention.”

Address SCADA Security Vulnerabilities NOW, Not Later (plus CoDeSys White Paper)

Who is responsible for fixing the thousands (some say 100,000) of vulnerabilities that exist in PLCs, DCS, RTUs and other automation devices that are in use in facilities around the world?

On the one hand, we have the position of Dale Peterson at Digital Bond. Dale ardently argues for (and takes) aggressive measures to pressure ICS vendors into making their products more secure. Through their 2012 Project Basecamp and subsequent disclosures, Digital Bond publically released vulnerability details for a large number of controllers.

SCADA Security Basics: Integrity Trumps Availability

In last week's blog, Heather wrote an excellent summary of Mark Cooksley's network security presentation regarding "Why Industrial Networks are Different than IT Networks". In it she noted that the number one goal of ICS security is based on the concern for safety. This is spot-on in my opinion. However, there is more to consider when it comes to industrial security priorities…

SCADA Security Basics: Why Industrial Networks are Different than IT Networks

Previously we looked at the question of “Why are PLCs so insecure?” Today we are going to come at SCADA security from another angle, which is “Why is securing Industrial Networks different than securing IT Networks?” We will also look at three ways to address these differences.

Shamoon Malware and SCADA Security – What are the Impacts?

Ed. Note: This is a significant update to an article first published on Sept 25, 2012. The original article is available as a download in Related Links.

SCADA Security: Tofino provides an Alternative to Patching

Last week I wrote about a serious issue in the patching of SCADA and ICS systems. Just when you think you are installing all needed patches, some critical ones are getting missed.

Awesome SCADA Security Operations Centre

To understand the problems faced by SCADA users, the team at Regency IT Consulting wanted to build a basic test rig. The goal with the rig was to help us understand the users’ challenges and to interact with the technology and protocols.

SCADA Security Basics: Why are PLCs so Insecure?

Last week Eric Byres addressed the difference between SCADA, ICS and other jargon in our industry. This week I am going to address a question I am often asked “Why are industrial networks so hard to secure?” This is a big topic, so today I will address only “Why are PLCs so Insecure?”

Pages

Subscribe to RSS - stuxnet