SCADA and Control System Security - Views From An Expert

Joseph Weiss is one of the leading experts in control system security. He provides some interesting insights about control systems and including SCADA, DCS and PLC and the security issues surrounding these in an interview found here.

He explains among other things that "A control system has several unique attributes. Number one, a control system must be absolutely highly reliable. It can't shut down very often. So, unlike a business system where you can shut it down over the weekend, the system that controls the power plant must have almost 100 percent reliability or some form of backup to maintain the 100 percent reliability. It is extremely important." This characteristic brings in itself a very unique perspective about security implementation related to control systems.

In a later part of the interview he has this to say about control systems getting hit: "My very, very, very strong feeling is, if and when we get hit, we will never know why we were hit. All we will know is breakers are opening, valves are closing, certain things are happening. But we won't have a clue as to why."

The interview contains a lot of other interesting insights and examples of incidents and lessons learnt that would be useful for anybody interested in CNII and control systems in particular. >> More ..

Catch me if you can star offers IT security advice

Frank Abagnale started off on the wrong side of the law by deceit and forgery to earn large amounts of money but was later caught. This was in the 60s when he was a teenager. His forgery talents did not go unnoticed and he was offered a job with the FBI in lieu of the rest of his jail sentence. His job is ... of course ... to pin down on forgery crimes.

His adventures were told in a book and a subsequent movie called "Catch me if you can".

This article is an interview with him where amongst other things he explained that:
1. It is way easier to commit forgery today than 40 years ago
2. We can have all the sophisticated security systems but the weakest link is still the human link.
3. Some laws passed recently are plain stupid.
4. Ethics must be reintroduced in education and must be a part of corporate culture.
5. We must be thinking out of the box when addressing security.
6. Simple solutions should be preferred than sophisticated ones.

While the above points appear obvious, it is certainly refreshing from a person who has been on both sides of the law. His thoughts and views are certainly key pointers for any entity managing critical infrastructures to gain a lesson or two from the perspective of security.