Download

Protecting Critical Infrastructure: Process Control and SCADA • Chapter 6 241patches and how closely you work with Microsoft, how quickly you can patch, how youare addressing this type of vulnerability and what implementation of Modbus you areusing, and whether you have looked at these types of issues with that protocol. Inresponse, vendors are starting to take action to address the legacy issues, as well as embedsecurity into their new products.That’s encouraging.Colby: Now scanning, that’s another big problem, right?Ben:Yes, scanning is a problem. Again, inadvertently, because they don’t have this understandingof the importance of availability on the control system side and there hasn’tbeen a dialogue, the IT guy tries to scan something on the control system network side.Colby: I think also that if you look at the security that’s happened as far as a lot of the ITtechnology companies, and online businesses, you don’t hear so much about them gettingbroken into anymore, so I think security practices have improved across the board.And I think that if they take the best practices from these companies that already haveonline entities like banks and other organizations, they will be ahead of the game.Ben: Absolutely—looking at the best practices and just applying them into the process controlenvironment. In the past, people have said they can’t use a particular antivirusproduct on PCs because the workload associated with the process of operation is sufficientlyhigh that if their box gets any further bogged down running it, it’s just not goingto perform well, and it might actually hiccup and bring the process down. People arestarting to look at that and say that maybe in some cases they actually can run that software.Certainly, bringing together the IT guys on the business side with the controlsystem guys and the physical security guys—bringing those folks together and gettingthem to talk and to understand that they do have shared responsibilities and that theycan work together—they’re going to be much more effective.Colby: It’s really the converged approach; convergence is just necessary.Ben:Yes, but thinking of it in broader terms, convergence of the security infrastructure—it’sthe technologies in the organizations, and the resources.Colby: At the end of the day, if the power goes down, eBay is not going to be running itsWeb site, so it should be willing to share its knowledge and experiences. It depends onthe critical infrastructure, just like anyone else.Ben: And you certainly see that in LOGIIC.You saw that with the commitment of the assetowners to open up and to share their understanding of the issues and to provide guidanceto the team toward the development of a solution that would be useful not only tothem, but (in their minds at least) also to the broader industry. Companies like Chevron,BP, Ergon, and Citgo that were part of LOGIIC, those organizations felt this shared