SCADA systems in Australia easy target for malware: Security expert
- 09 August, 2012 09:38
Gas, electricity, water and transport systems controlled by Supervisory Control and Data Acquisition (SCADA) systems are vulnerable to malware infection because of a lack of PC patching and anti-virus programs, according to a security expert.
CQR director of technical assurance, Phil Kernick, told CIO Australia that almost all of the SCADA attacks he has investigated are related to malware infections.
In-depth: Information security 2011 Research Report.
“It’s the same type of malware that the Eastern European bad guys are trying to put on your home PC to steal your banking credentials,” he said. “If it gets into a control network, it sometimes crashes machines.
“Control network PCs need to be running all the time and not just randomly re-boot.”
Kernick said the malware also gets in because of the “porous” inter connection between the control network and the corporate network, staff inserting USB keys into unpatched computers, and contractors connecting their laptop to the network and accidently unleashing malware into the system.
According to Kernick, an additional problem is that SCADA systems are not run by the corporate IT departments in critical infrastructure companies but by the engineering department.
He said that the engineering and IT departments at critical infrastructure companies needed to “stop throwing rocks at each other” and start working together on SCADA systems.
“Even though these are process control systems they are still made out of IT systems and the best practises such as patching and strong passwords need to be applied."
He said SCADA system owners should also:
- Conduct a SCADA security risk assessment, including penetration testing if appropriate, and conduct regular vulnerability testing.
- Create SCADA security policy, so use a risk-based approached focused on credible threats.
- Develop governance processes to manage vulnerabilities and actions during security events.
- Assign SCADA security responsibility, so use line managers and have performance externally audited.
- Train staff, especially those in engineering who are usually responsible for the operation of SCADA infrastructure, to be security conscious.
- Legal obligations: ensure you meet your customers’ increasingly complex legal obligations for cyber security.
- Business continuity: plan for the worst (including disaster recovery) and design future SCADA systems with security as a key deliverable.
Kernick added that these measures should help critical infrastructure companies avoid having to report a security incident to shareholders.
“If something goes wrong and you have to disclose that information, it will manifestly affect your share price,” he said.
"Therefore, the business has a very good incentive to protect these systems so they don’t have to disclose an attack.”
Follow Hamish Barwick on Twitter: @HamishBarwick
Join the CIO Australia group on LinkedIn. The group is open to CIOs, IT Directors, COOs, CTOs and senior IT managers.
Why change management doesn’t work
Larry Page wants to see your medical records
Dual-Persona Smartphones Not a BYOD Panacea
After two-year hiatus, EFF accepts bitcoin donations again
CIOs struggle to deliver timely mobile business apps: survey
The Foundation for Cloud Management
For businesses looking to provide real-time business solutions to employees and customers alike, you need to have a comprehensive network management strategy. The network is the foundation of all successful cloud services; it must be robust to meet traffic, efficiency, and performance demands. Download today the four steps to get your network operations cloud-ready.
Saving Time and Money with Savvy Use of Flash in Automated Storage Tiering
In a sluggish economy, getting the best ROI on every IT dollar spent is the top priority for almost every business. Storage budgets in most IT environments continue to remain flat or are capped as a percentage of the overall IT spend, while data storage requirements continue to grow at an unsustainable pace. Download now to learn about the benefits of using flash in automated storage tiering.
Securing the Promise of Virtualisation
For today’s enterprise, this whitepaper identifies three general areas of risk associated with risk; those that are traditionally areas of risk, the hazards that are exclusive to virtualisation and the more recent set of risks that are associated with newly formed hybrid environments. Read more to find out how to keep pace with evolving threats, quicker provisioning and dynamically mobile workloads.