When someone as experienced and wise as Joe Slowik questions your analysis, it makes me rethink if I’m wrong, didn’t state my position and rationale clearly, or both. I think in this case I need more words and an analogy to get my point across.
Joe responded to a short item comparing a local wastewater incident’s impact to the July water utility cyberattacks in my Friday News & Notes. Pull quote:
Refusing to acknowledge implications (a state-sponsored adversary engaged in widespread targeting of critical infrastructure for intended disruption) in the face of effect failure isn’t “thought leadership” or being a “catalyst,” it is burying your head in the sand despite operational reality.
I have a few issues with the OT security community’s response and generated content to the July water utility incidents, and many other incidents.
- The impact is sensationalized as compared to all cause incident impact in a year. This was the point of my noting a typical water utility incident that occurred last week on my island. These and higher impact incidents happen all over the country every week.
- The OT security community swarms to the incident du jour. It’s like 4-year olds playing soccer and all chasing the ball.
- Most importantly, it leads to a misallocation, and often a waste, of attention and limited resources. Misallocation for the asset owner. Misallocation for government efforts. Misallocation for …
The clear lesson from the July water utility incidents is OT cyber assets should not be accessible by anyone from the Internet. This is true for small, medium, and large asset owner/operators. This is not new. There are now additional, more compelling, data points.
Get OT off the Internet is being said, and it is being muddled with 74 additional messages and well meaning advice. Over 100 water utilities were hacked, and this is why you need to do a, b, c, … x, y and z. Mixed in with a bit of I told you so and sometimes condescension.
Let’s try an analogy.
As someone in their 60’s, I remember a time when you could leave valuables visible in the car when you went into the office, store, or restaurant. They would be there when you came back. Just like there was a time where Internet connected OT systems would not be taken down or used to alter a process.
Times changed. Smash and grab became common. If you left your laptop or purse in the passenger seat or backseat of your car, there was a non-small chance you would come back with a smashed window and stolen valuables.
Once it happened to you, or someone you were close to, you learned to put things out of sight or take them with you. Even if you left them in the trunk or hidden under the seat, it greatly reduced the likelihood you would come back to a smashed window.
There are many other things besides hiding valuables that can be done to stop or reduce the auto smash & grabs:
- Better lighting to make the thieves more visible in a busy parking lot
- Guards patrolling the parking lot
- Cameras detecting smash and grab and a response capability
- Windows that are almost impossible to smash
- A perimeter that is difficult to scale and entry / exit controls
- …
None of these additional security controls are wrong. They probably will reduce the frequency / likelihood of smash and grabs to some degree. None of them are as simple, cheap, or effective as don’t leave your valuables visible in a car.
Those additional smash and grab security controls are used in some cases, certain buildings and certain vehicles (large utilities). They are unlikely to be practical or affordable in places like neighborhood strip malls or small office buildings (your small water utility).
If these security controls are required by code, their cost could put the strip mall and store out of business or increase the cost of everything to their customers. And in most cases this cost would be unnecessary if valuables were not left in plain sight in the car.
We have 10+ years of data on OT cyber assets that are Internet accessible from Shodan and other sources. It is easy to see if we are making progress removing OT cyber assets from the Internet. Any response to the July water utility incidents, and similar Internet connected OT cyber incidents, that does not
- Focus on removing unrestricted Internet access to OT cyber assets, and
- measure the reduction in Internet accessible OT cyber assets
is not following the very clear data.
We can argue about what should be done next.