Hacker News Reader

Comment by mindslight | Hacker News Reader

Good. Malicious crackers, please destroy as many non-safety-critical water pumps as it takes for people to take security on these systems seriously. It seems most of the industrial controls industry is used to operating on a proprietary network, and when moving to IP their guess at security is "uh, firewall?".

View on HN

This is indeed odd. On my home network, I have a firewall at the edge, a firewall on each machine, and every service requires authentication (cryptographic where possible; username+password over SSL otherwise). It took me about a day to set up, and I'm not even a security person.

It's unacceptable that people whose jobs are to secure computer networks do a worse job than I do for the little computer under my TV.

(Yup, all of my machines at home have a public IP address. Convenient!)

SCADA systems often rely on time-deterministic routing of packets, which TCP/IP doesn't make easy. There are a number of issues with securing them, including the fact that unscheduled downtime can be catastrophic (ergo, no hotpatching without massive work).

There are some good posts on the SCADASEC mailing list. There are some lousy posts as well.

Culturally, SCADA system security is approximately where IT systems were in in 1995 with Windows 95.

Second this, as per other comment I made as well. SCADA systems are generally unstable and very precious about how they are implemented, it can drive people to make a lot of concessions. Thankfully we run enough support staff to ensure physical site visits are possible, which eliminates the security and technical issues associated with trying to tie these things into a WAN.

*edit, inferring that instability can drive people to network these devices for support reasons.

how many users does your home system have? what is your budget like to support them? what is your pain point for "at this overhead we just go out of business?"

it's a lot more complicated than "just do it right".

I'm not saying we shouldn't take effort to do it right, but right now the market doesn't price for security so ...

How many users does a water pump have?

Hell, this probably shouldn't have been networked in the first place.

Many things that should not be remotely controlled are. Control freaks are in control of too much of the world. The next time you are uncomfortably hot or cold in a Walmart, don't bother complaining to the store management, it is all controlled, as are the coolers and freezers, from Arkansas.

That's not even it though? Shouldn't systems like this be air-gapped?

I'm amazed that the concept of "air gap" isn't standard operating procedure at any utility.

It is. Just the loose ones make the papers. We run physical divisions on our control systems, even system to system. Lots of walking area to area to do work but none of it will see each other or any WAN configurations. Thank goodness.

so lets say that you don't have the budget to keep a fully trained staff of scada and network engineers on site, 24/7. and then there's a systems failure, and the choice is either "they debug it remotely and fix the problem within an hour" or "the staff drives 2-3 hours to the location where the airgapped systems are and then begins work".

now imagine the system is life-preserving or otherwise critical. those 2-3 hours could be hundreds of lives. wouldn't it be criminally irresponsible to not have the system as resilient as possible?

I would say any system whose failure quickly results in the loss of life should always have properly trained staff either on location or trivially close. Anything less than that would be, as you put it, criminally irresponsible, as is the idea of connecting such infrastructure to publicly accessible networks.

I don't think you'd like what your power bill would look like if your distribution company had to have staff trivially close to all of its infrastructure, 24/7. I work at a utility and all (yes, all) of our stations and substations are unmanned.

To have a crew on site at every station, 24/7, you'd be looking at nearly 1,000 employees at $65-90k, assuming 8-hour shifts.

It's almost like you're saying no one has now or ever built an affordable water supply system that can supply water unless it is run remotely through the internet.

Pretty sure that's not the case since internet controlled systems are solidly in the minority.

That depends on how the cost-benefit analysis came out. You did do a cost-benefit analysis, right?

Personally, I would consider connecting critical infrastructure to the Internet without taking adequate security measures to be the criminally irresponsible thing. Of course, water pumps aren't really "critical infrastructure" in the same sense as, say, nuclear power plants. Hopefully their security is a little more reasonable.

Cost-benefit what?

I work for one of the largest municipal electric utilities in North America. We are a monopoly and do not set our own rates. There is no such thing as "cost-benefit" for us. We spend as much money as we need to get the reliability our regulator demands, and then our rates are set accordingly for us to recover those costs.

Maybe, but for my parents (i.e. non-tech folks) the solution would be more likely "put more police on the internet to catch those criminals".

Reply on news.ycombinator.com