SCADA systems in Australia easy target for malware: Security expert
- 09 August, 2012 09:38
Gas, electricity, water and transport systems controlled by Supervisory Control and Data Acquisition (SCADA) systems are vulnerable to malware infection because of a lack of PC patching and anti-virus programs, according to a security expert.
CQR director of technical assurance, Phil Kernick, told CIO Australia that almost all of the SCADA attacks he has investigated are related to malware infections.
In-depth: Information security 2011 Research Report.
“It’s the same type of malware that the Eastern European bad guys are trying to put on your home PC to steal your banking credentials,” he said. “If it gets into a control network, it sometimes crashes machines.
“Control network PCs need to be running all the time and not just randomly re-boot.”
Kernick said the malware also gets in because of the “porous” inter connection between the control network and the corporate network, staff inserting USB keys into unpatched computers, and contractors connecting their laptop to the network and accidently unleashing malware into the system.
According to Kernick, an additional problem is that SCADA systems are not run by the corporate IT departments in critical infrastructure companies but by the engineering department.
He said that the engineering and IT departments at critical infrastructure companies needed to “stop throwing rocks at each other” and start working together on SCADA systems.
“Even though these are process control systems they are still made out of IT systems and the best practises such as patching and strong passwords need to be applied."
He said SCADA system owners should also:
- Conduct a SCADA security risk assessment, including penetration testing if appropriate, and conduct regular vulnerability testing.
- Create SCADA security policy, so use a risk-based approached focused on credible threats.
- Develop governance processes to manage vulnerabilities and actions during security events.
- Assign SCADA security responsibility, so use line managers and have performance externally audited.
- Train staff, especially those in engineering who are usually responsible for the operation of SCADA infrastructure, to be security conscious.
- Legal obligations: ensure you meet your customers’ increasingly complex legal obligations for cyber security.
- Business continuity: plan for the worst (including disaster recovery) and design future SCADA systems with security as a key deliverable.
Kernick added that these measures should help critical infrastructure companies avoid having to report a security incident to shareholders.
“If something goes wrong and you have to disclose that information, it will manifestly affect your share price,” he said.
"Therefore, the business has a very good incentive to protect these systems so they don’t have to disclose an attack.”
Follow Hamish Barwick on Twitter: @HamishBarwick
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
CIOs say cost, complexity impede true mobile gains in enterprise
The enlightened CIO’s guide to running projects
The enlightened CIO’s guide to running projects
Why IT projects really fail
Queensland government to provide 200 services online by 2015
Embracing Behaviour-Based Pricing Models
The telecommunications industry is one of the most challenged, fast-moving and evolving industries thanks to the worldwide embrace of mobile lifestyles that demand new services, solutions and experiences. In this survey, we investigate where and how new thinking around data, analytics and the actionable customer intelligence can further monetise mobile subscribers. Click to download!
How to Compare Application Delivery Controllers
Application delivery controllers (ADCs) are one of the most critical elements of cloud infrastructures and enterprise data centre architectures. ADCs strongly impact performance, scale and security of the entire application environment, so it is extremely important for IT leaders to choose the right one. In this whitepaper, we look at 9 competing ways to compare ADCs and what products step up.
Power of Three: Building Mobile Initiatives Guided by Business Goals, Technology and Governance
The use of powerful mobile devices has become so widespread, industry leaders in almost every sector have embraced mobility solutions as central elements of their IT and business operations. As mobile budgets grow, so does the influence of business units on mobility strategy. However, without a comprehensive strategy that encompass business goals, policies and processes, then initiatives into mobility will struggle to deliver the expected benefits. Click to download!