April 2011 - Control Global

More documents

Recommendations

Info

S e c u r i t y S p o t l i g h t Do Firms Expect Too Much Cyber Threat Data? Michael Peters infr as tructure and cybersecurit y advisor Michael.Peters@ ferc.gov A recent U.S. General Accounting Office (GAO) report [GAO-10-628, “Critical Infrastructure Protection Key Private and Public Cyber Expectations Need to Be Consistently Addressed,” www.gao.gov/products/GAO-10-628 ] reveals that a key expectation from industry is for actionable cyber-threat information from the federal government. Critical infrastructure companies should assume that the threat level is “1,” meaning a viable cyber threat to their control systems exists. The dissemination of this tactical level of information has not been completely met (see sidebar). Because of this lack of information, a company may choose not to implement cybersecurity defenses because it feels there is no threat. I believe this reliance on tactical threat information is a false interpretation of the environment, and is a major impediment to securing our critical infrastructures from attack. I do not believe this tactical level of information is necessary for a critical infrastructure company to implement cybersecurity defenses. The federal government has provided strategic-level, cyber-threat information to the various critical infrastructures, and this type of information sharing can easily continue because the strategic threat is the information that the government most likely will be able to acquire and distribute. However, even this level of threat information really isn’t necessary in order to justify and implement cybersecurity defenses. Many threat actors exist today that can impact the security of a control system—traditional hackers, criminals, disgruntled insiders, terrorists and nation-states. All of them have a range of capabilities and intents, though the common assumption is that the nation-state is the most technically sophisticated, and the hacker is the least. Many of these adversaries are capable of very structured as well as unstructured operations. What is crucial is that the level of sophistication, structure and capabilities varies for all the adversary types. A security professional should never assume that a specific type of adversary has “specific” traits. Wobbly Threat Leg? Understanding these adversaries and determining their capabilities and intents is a very difficult problem and often results in lessthan-complete information. However, this information forms the basis of the “threat leg” of the traditional risk equation: Risk = Threat x Vulnerability x Consequences. This lack of information often results in reducing the perceived risk to the system. However, what every critical infrastructure company should assume is that one or more of these adversaries eventually will attack them. Critical infrastructure companies should assume that the threat level is “1,” meaning a viable cyber threat to their control systems exists. What threat actor attacks them is immaterial. What companies and their customers should care about is that their system has been exploited, and the services/products that the company provides are not available. Now, a frequent counter-argument raised by the critical infrastructure companies is that they can’t afford to address everything, and that, without this threat information they don’t know what to fix and how to spend their resources. While this is true, I believe that there is a better way of determining where to spend scarce cybersecurity dollars than waiting for tactical cyber-threat information that they may not receive and would probably be constantly changing, even if it were readily available. Two Security Perspectives I think critical infrastructure companies should examine themselves from two main perspectives, and not rely on threat information. The first is most directly tied to the mission of the company, whether it is providing electricity, making potable water, refining gasoline or manufacturing televisions, etc. Companies create “tiger teams” of specialists, including their most knowledgeable operators, control system experts and IT personnel, and charge them with the task of developing scenarios for causing the most harm, destruction or danger to company personnel or to 14 www.controlglobal.com A p r i l / 2 0 1 1
Demands in tank gauging will only increase. Time to discover a new system? The all-new Raptor tank gauging system is well worth a closer look. With Raptor you are better equipped to handle the ever-increasing demands on efficiency, safety and accuracy. The system is open and scalable, and offers new levels of safety as well as IEC 62591 (WirelessHART) technology. It measures with unsurpassed accuracy for precise bulk liquid inventory management and custody transfer. Visit www.rosemount-tg.com to learn more and watch our interactive presentation about Raptor. Or call us direct to book a personal meeting. The all-new Raptor tank gauging system Always ready for your next challenge Emerson Process Management Rosemount Tank Gauging North America Inc. 10700 Hammerly Blvd., Ste.115, Houston, Texas 77043 Tel: 800-722-2865 sales.rtg.hou@Emerson.com The Emerson logo is a trademark and service mark of Emerson Electric Co. © 2006 Emerson Electric Co.
Page 1 and 2: Information Wants to Be How ya gonn
Page 3 and 4: Where Do I Go for Automation Produc
Page 5 and 6: April 2011 • Volume XXIV • Numb
Page 7 and 8: April 2011 • Volume XXIV • Numb
Page 9 and 10: E D I T O R ’ S P A G E It’s Al
Page 11 and 12: C O N T R O L O N L I N E KATHERINE
Page 13: THE HIDDEN FIELDBUS NETWORK THE RIG
Page 17 and 18: ® The “Big Easy” comes to guid
Page 19 and 20: You can win the battle with this ec
Page 21 and 22: o can help. ationDirect /Part Numbe
Page 23 and 24: O N T H E B U S Attack of the Mutan
Page 25 and 26: Harnessing The Power Process Gas Ch
Page 27 and 28: The Complete Control Cabinet Soluti
Page 29 and 30: Ohmart/VEGA is now proud to be VEGA
Page 31 and 32: R E S O U R C E S Where to Go for H
Page 33 and 34: T h e M o b i l e W o r k e r infor
Page 36: T H E M O B I L E W O R K E R Fred
Page 39 and 40: When accuracy counts, why settle fo
Page 41 and 42: When should I start to modernize my
Page 43 and 44: V200 V100 The “VAC PAC” A packa
Page 45 and 46: F l o w Even without these excursio
Page 47 and 48: S C A D A Remote Wind Energy SCADA
Page 49 and 50: S C A D A REMOTE WIND ENERGY SCADA
Page 51 and 52: The data acquisition that occurs is
Page 53 and 54: a s k t h e e x p e r t S cations s
Page 55 and 56: P r o d u c t i n t r o d u c t i o
Page 57 and 58: These Books Are Not For Sale ® The
Page 59 and 60: C O N T R O L T A L K Ultimate Limi
Page 61 and 62: A d i N D E X Advertiser Page No.
Page 63 and 64: Import your Modicon 984 ladder logi

April 2011 - Control Global

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?