Hackers induce 'CATASTROPHIC FAILURE' in mock oil well

Re: Which

air gap <> firewall. An air gap means NO connection, a firewall means a possible connection, and if you don't need it, no connection is always better.

Re: Which

Having attended a number of energy industry security conferences in the UK I can tell you that they use separate networks for the industrial control systems and corporate networks. Firms that design rigs even have multiple computers on an engineers's desk - one for email, web, etc and another for doing the actual design work where everything is encrypted and there is no transfer of data between the two.

Those attending security conferences tend to be companies that take security seriously - for every company at these conferences there are 10 more that haven't bothered to attend.

I worked in the oil industry for 4 years developing control systems, and we only had a single machine on our desks. Corporate network access for emails and development were done from the same machine (even getting a second monitor was almost impossible, let alone a second machine).

There was no thought to security at all on the product I worked with (and I doubt that has changed on the newer products). The only attempt at security was to insist the client put the control system on a separate network to the rest of the platform, however I know this was not done on a few projects.

In these systems, simply gaining access to the same network would give you complete control of the entire system. You would then be free to open any valves you wish, with no logic in the controller to prevent dangerous operations.

Posted Anonymously for obvious reasons.

Re: Which

That is indeed how it should be, total separation between ICS and office networks.

Unfortunately that is far from everyday common practice. Even safety systems should have a total separation which isn't common practice either.

And I'm not even considering vendor VPNs, old modems for remote access or wireless.

Essentially it mostly boils down to a misunderstanding between IT and process engeneers.

Re: OMFG. How is this even *possible* in 2013?

" they may choose to just tap into the existing network which already has a connection between the two areas."

"Running new cables may require shutting down production - good luck getting approval for that!"

Isn't that what vLAN-capable kit (e.g. switches) is for? I'm several years behind, so correction welcome.

One set of cables, carrying multiple logically-independent networks?

Actually presumably two sets of cables, for resilience, with dual sets of switches and dual-homed kit?

OK it introduces complexity, which in itself can often increase risk, but it's a tradeoff between the risk of having dumb switches and all traffic visible to all kit (doesn't sound good to me) on the one hand, and on the other hand a slightly more complex network where (given proper practices) kit can only see the network traffic on the vLAN they're supposed to be using.

My £50 SoHo router at home can do this. An enterprise or industrial switch used to be able to do this. Do they not still do this?

Re: @Irongut

"Even if correct, which i'd be inclined to ask for some evidence for, this neglects the controllers already deployed - which was much of the thrust of the presentation".

Fair comment. I think there's good evidence that most agencies who are supporting critical national infrastructure in the UK are indeed following the right protocols - if only because CPNI (more power to their elbows on this one) have been campaigning in this area for some years

I also take your point about ICS systems and economic constraints - they're built down to a budget, of course they are, and vendors are not particularly impressive when it comes to the implementation of secure design. But if they remain isolated, I'll maintain that there isnt an issue.

The control systems that tend to worry me are those linked with with or developed from building management systems, particularly those associated with large public venues. BMS systems dont get a lot of publicity in terms of security controls which causes me to wonder how well they are actually controlled.