Last week I attended, presented and tweeted at the Dept of Energy Cybersecurity For Energy Delivery Systems Peer Review. The idea is DoE funds all these research projects, and they would like a group of owner operators and other industry guru’s to help determine...
Pay attention to the P in Advanced Persistent Threat [APT]. Most of the attention paid to the trojan with a payload targeting Siemens control system applications has been on the Advanced nature of this malware. And that attention is warranted because there has not...
Joseph Kelliher was the Chairman of FERC from July 2005 – January 2009 so he had a front row seat to the NERC ERO / FERC / Congress issues and enough time to get perspective from outside the FERC bubble. On April 28th he gave a speech at an Energy Bar...
A few thoughts on the Perfect Citizen project by NSA. First, it is unclear what Perfect Citizen is. The news reports said the program would places sensors in the critical infrastructure to detect cyber attacks. NSA says “Perfect Citizen is purely a...
A common fault in control system security programs is in recovery of cyber assets. The redundancy gives a false sense of security, and the questions “can you rebuilt this server” or “when was the last time you rebuilt this server” often go back...
The Economist Magazine has a 2744-word cover article on “Cyberwar”. Like most articles in this publication it is balanced and presents the issues well. They have both Richard Clarke with his alarms and Bruce Schneier calling scaremongering. There is...
Protecting Industrial Control Systems From Electronic Threats by Joseph Weiss 7 Word Review – Missing: a quality editor. Pass on this. Joe Weiss’s, one of the pioneers in control system security, attempt at writing an overarching book on control system...
NERC has just issued the first Clarification Application Note [CAN] related to the CIP standards. The CAN process should be very helpful for owner/operators, vendors and auditors by removing some of the interpretation on what the standards mean and require. That said,...
Is CIP improving the security posture of electric sector control systems? I think we have a large enough sample size and time to answer that question now. Like most things in life, it is not a simple yes or no. It is affected by an organizations previous efforts on...
Matt Olney from Sourcefire has a lengthy editorial on the Lieberman-Collins Protecting Cyberspace As A National Asset Act. I haven’t read the 197 page bill cover-to-cover, but did glance at the sections that Matt highlighted in his editorial. What was a bit...
