In case you missed it, ICS-CERT issued an advisory about using SHODAN for identifying SCADA components connected to the Internet. The advisory covers the issues and the IT news outlets are picking up the story as well. Rather than echo that information or complain...
The concept of information sharing among a community of vetted users is appealing – – and it has been tried numerous times. Back in the ’90s when InfraGard started membership grew quickly at the promise of getting threat and attack information from...
My previous blog on Version 2 of the WIB Security Requirement for Vendors reads a bit like a security assessment report. While it highlights some positives, most of the details are on the deficiencies. To be clear, it is one of the better documents in this space and...
I was tough on ICS-CERT’s performance on Stuxnet in an earlier post. Now ICS-CERT is reaching out to a number of people in the control system community, including Digital Bond, to get some candid feedback on what they need to do differently or better. There is...
Back in April we reviewed Version 1 of the WIB/Wurldtech/Shell Process Control Domain – Security Requirements for Vendors. While it was a useful guideline document, it had major problems that needed to be solved before it could be used for a vendor certification...
Ralph has an open letter to Symantec up on his site. While I’ve been known to point out a failure from time to time in this blog, I think in this case Ralph is unnecessarily rough on Symantec who has done fantastic work on Stuxnet. However if you ignore the...
If you have been thinking ISA 100 is the future wireless standard for control systems, you must read Walt Boyes analysis that the battle is over and Wireless HART has won. The tone and tenor of presentations I have been hearing for years is that ISA 100 is ready for...
I learned via @jimcahill of Bob Huba’s presentation on a new smart firewall offering at the Emerson Delta V Global User Exchange and was eager to learn more. An article on ControlGlobal has limited details on it, but more interesting was the step back in time by...
Jason touched on the growing frustration with NERC CIP, and the realization that in many ways the CIP mandated compliance focus is actually impeding security progress. Joe Weiss has led the charge that CIP should be replaced with NIST SP800-53, but this comes as the...
Symantec posted yesterday the definitive analysis of Stuxnet to date. It’s long, detailed, easily understood and overall a fantastic piece of work. Evidently they were holding this detail for a conference on the 29th and even more detail will be available in a...
