Feeds

SCADA system makers urged to tighten security

Utility providers support new guidelines

Top 5 reasons to deploy VMware with Tegile

Idaho National Laboratory and the New York State Office of Cyber Security and Critical Infrastructure have teamed up with utilities and makers of distributed control system software to offer advice on how to make system security a major part of the critical infrastructure.

Later this week, the group will release the latest draft of a set of guidelines for utilities and manufacturers that offers specific requirements for suppliers of supervisory control and data acquisition (SCADA) systems, SecurityFocus has learned.

The guidelines aim to elevate system security to an explicit part of negotiations between customer and supplier with the goal of making the next generation of critical infrastructure systems more secure than today's software and hardware.

"We think we can identify the common weaknesses in regards to security and also identify places where the technology's security can be tightened up," said Michael Assante, infrastructure protection strategist for Idaho National Laboratory.

"The response from vendors has been surprisingly good - this could be seen as a threatening thing, but they are prepared to provide more security."

The security issues of real-time control systems, of which the best known are SCADA systems, has become a focus of both private industry and the government as worries mount that such systems could be used as the vector for a criminal or terrorist attack.

While companies and security researchers are starting to tackle the ticklish issue of when and how to disclose vulnerabilities in such systems, cybersecurity incidents that affect such systems are rarely reported.

Because incidents and vulnerabilities are rarely talked about in the industry, three security professionals sought a better way to convince vendors to provide better security.

The three - INL's Assante, William Pelgrin from the New York State Office of Cyber Security and Critical Infrastructure, and Alan Paller, director of research for the SANS Institute - decided to create a catalog of security requirements for control systems along with language that could be inserted into a supplier's contract. The initiative is funded by the Department of Homeland Security.

The guidelines, known as the Cyber Security Procurement Language for Control Systems, cover topics including the removal of unnecessary services and programs to harden the system, furnishing the minimum firewall ruleset necessary for operation so that perimeter security is not weakened, and disabling or modifying guest and other well-known accounts.

Moreover, the guidelines offer companies language to mandate that the control system maker provide guarantees of certain coding practices, a process to remediate flaws and the ability to detect malicious software running on the system.

Among the companies supporting the initiative are the New York Power Authority, the New York Independent System Operator, and ConEdison, which announced on Wednesday that power had been restored to almost all customers in Queens, NY, following a week-long outage. The company had technicians going manhole to manhole in that district because it lacked distributed data gathering systems to detect which parts of its local grid had burned out.

Detecting physical failures to avert major power outages and finding manufacturing problems are some of the reasons SCADA systems and other distributed control systems are installed. However, the creators of such systems, historically, have not paid attention to cybersecurity, said SANS' Paller.

"It's not that these guys don't know what they are doing," Paller said. "Part of it is that these systems were engineered 20 years ago, and part of it is that the engineers designed these things assuming they would be isolated. But - wham! - they are not isolated anymore."

Internet Security Threat Report 2014

More from The Register

next story
'Kim Kardashian snaps naked selfies with a BLACKBERRY'. *Twitterati gasps*
More alleged private, nude celeb pics appear online
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
Freenode IRC users told to change passwords after securo-breach
Miscreants probably got in, you guys know the drill by now
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
BitTorrent's peer-to-peer chat app Bleep goes live as public alpha
A good day for privacy as invisble.im also reveals its approach to untraceable chats
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.