October 3, 2012 by Darin Andersen 

To recognize October as Cyber Security Month as well as increase awareness and offer concrete solutions to today’s cyber security issues, Norman is launching a video series starting today.  The series will include interviews with several senior corporate and utility executives and many of the nation’s leading cyber security experts.  We plan to post one new video weekly through roughly the end of the year.

In the premiere video, available here, I introduce the series and quickly turn it over to Joe Weiss, managing partner of Applied Control Systems, and former IT manager at the Electric Power Research Institute  (EPRI).   Please take a few minutes to watch Joe’s segment, he touches on several important developments in today’s worldwide security environment.

Starting with “What scares me most,” Joe points out that prior to two years ago, security experts assumed that major cyber attacks could only be generated by nation-states.  Stuxnet quashed those assumptions.  Several organizations have placed Metasploits on the web for free, meaning a hacker no longer needs the resources of a nation-state to identify the vulnerabilities of a utility or organization’s industrial control system.   He also reminds us that SCADA and industrial control systems are not synonymous – SCADA is just one type of ICS. Focusing on “SCADA” threats is just one piece of a large puzzle.

He continued by highlighting the global nature of today’s control systems, noting that many ICS vendors are based in the U.S. but sell worldwide, while many others are based overseas and sell here.  He particularly commented on China, noting China is not the significant threat many think it is.  Chinese companies have purchased control systems from all major U.S. vendors, as well as many international vendors.   In addition, companies that employ industrial control systems are globally connected; many U.S. manufacturers operate factories all over the world from the U.S., and conversely many companies based overseas remotely manage factories in the U.S.

Joe closes by reminding us that solving cyber threat issues in one industry and it becomes solvable in all industries worldwide.

Next week, we will feature the second in Joe Weiss’ three part series.  Joe talks specifically about the effects of cyber attacks that have occurred in the form of train crashes, gas line ruptures, and electric outages—and how solving one of these problems may well solve 80 per cent of them.

One upside of Cyber Security Awareness month is the energy the security community will generate to discuss today’s latest threats, trends and solutions.  I hope you will join me in devoting time to watching our videos and sharing your comments and expertise.