Subscribe to CIO Magazine »

SCADA systems in Australia easy target for malware: Security expert

Lack of patching, anti-virus on PCs which run SCADA systems need addressing, says security consultant

Gas, electricity, water and transport systems controlled by Supervisory Control and Data Acquisition (SCADA) systems are vulnerable to malware infection because of a lack of PC patching and anti-virus programs, according to a security expert.

CQR director of technical assurance, Phil Kernick, told CIO Australia that almost all of the SCADA attacks he has investigated are related to malware infections.

In-depth: Information security 2011 Research Report.

“It’s the same type of malware that the Eastern European bad guys are trying to put on your home PC to steal your banking credentials,” he said. “If it gets into a control network, it sometimes crashes machines.

“Control network PCs need to be running all the time and not just randomly re-boot.”

Kernick said the malware also gets in because of the “porous” inter connection between the control network and the corporate network, staff inserting USB keys into unpatched computers, and contractors connecting their laptop to the network and accidently unleashing malware into the system.

According to Kernick, an additional problem is that SCADA systems are not run by the corporate IT departments in critical infrastructure companies but by the engineering department.

He said that the engineering and IT departments at critical infrastructure companies needed to “stop throwing rocks at each other” and start working together on SCADA systems.

“Even though these are process control systems they are still made out of IT systems and the best practises such as patching and strong passwords need to be applied."

He said SCADA system owners should also:

  • Conduct a SCADA security risk assessment, including penetration testing if appropriate, and conduct regular vulnerability testing.

  • Create SCADA security policy, so use a risk-based approached focused on credible threats.

  • Develop governance processes to manage vulnerabilities and actions during security events.

  • Assign SCADA security responsibility, so use line managers and have performance externally audited.

  • Train staff, especially those in engineering who are usually responsible for the operation of SCADA infrastructure, to be security conscious.

  • Legal obligations: ensure you meet your customers’ increasingly complex legal obligations for cyber security.

  • Business continuity: plan for the worst (including disaster recovery) and design future SCADA systems with security as a key deliverable.

Kernick added that these measures should help critical infrastructure companies avoid having to report a security incident to shareholders.

“If something goes wrong and you have to disclose that information, it will manifestly affect your share price,” he said.

"Therefore, the business has a very good incentive to protect these systems so they don’t have to disclose an attack.”

Follow Hamish Barwick on Twitter: @HamishBarwick

Follow CIO Australia on Twitter and Like us on Facebook… Twitter: @CIO_Australia, Facebook: CIO Australia, or take part in the CIO conversation on LinkedIn: CIO Australia

Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.

References show all
Comments are now closed.
Related Whitepapers
Latest Stories
Community Comments
Latest Blog Posts
  • The F5 DDoS Protection Reference Architecture part 1 of 3
    Distributed denial of service attacks (DDoS) attempt to make a machine or network resource unavailable to its intended users, with a wave of crippling attacks on enterprises since 2012. This whitepaper offers guidance to security and network architects in designing, deploying, and managing architecture to protect against increasingly sophisticated, application-layer DDoS attacks.
    Learn more »
  • Case Study: Fox Sports
    Fox Sports Australia needed a way to deal with explosive data growth while moving to a new purpose-built studio and production facility. Read how an internal private broadcaster helped the broadcaster meet these challenges while savings costs, decreasing system implementation time and reducing IT support calls by 75%.
    Learn more »
  • Case Study: Steel Blue
    Read how Perth-based safety footwear manufacturer, Steel Blue, was able to cut costs with shipping and improve efficiency while meeting the growing demand for their products as they expanded their national and export markets and increased their local market share, all thanks to a new ERP system.
    Learn more »
All whitepapers
rhs_login_lockGet exclusive access to Invitation only events CIO, reports & analysis.
Salary Calculator

Supplied by

View the full Peoplebank ICT Salary & Employment Index

Recent comments