Posts Tagged ‘cyber security’
Tuesday, May 21, 2013 @ 06:05 PM gHale
U.S. power utilities face constant cyber attacks on critical systems, according to a report by two Democratic lawmakers. This report comes out amid warnings from the Obama administration that foreign hackers are constantly seeking ways to punch holes in the electric grid.
Congressmen Edward Markey of Massachusetts and Henry Waxman of California disclosed their findings as the House Energy and Commerce Committee held a hearing on cyber security.
RELATED STORIES
Bipartisan Security Act in Senate
Cyber Attack Teams Forming
Private, Public Sector Share Data
Obama Inks Cyber Security Order
In preparing the report, the two legislators asked 160 utilities to describe their experiences fighting cyber attacks over the past five years.
More than a dozen utilities said they experienced daily, constant or frequent attempted attacks, according to a 35-page report summarizing their responses.
The report cited an unidentified Northeastern power provider as saying it was under constant attack from cyber criminals as well as activist groups who have been targeting firms in the energy sector over the past few years.
A power provider from the Midwest said it experienced daily probes of its systems: “Much of this activity is automated and dynamic in nature, able to adapt to what is discovered during its probing process,” the company said.
The U.S. public has become more aware of cyber threats against the grid and other critical infrastructure since late last year, when Obama Administration officials began warning foreign enemies are looking to sabotage the U.S. power grid, air traffic control systems, financial institutions and other infrastructure.
Senior administration officials said they do not know of any successful destructive attack on the grid or other key infrastructure, but fear that hackers may have the ability to do so.
A bipartisan cyber security bill to protect the electric grid, introduced in 2010 by Markey and Waxman, passed the House of Representatives but not the Senate. Cyber security legislation remains in a holding pattern.
Friday, May 10, 2013 @ 04:05 PM gHale
Iran’s nuclear and hydropower facilities are well protected from cyber attacks and even the most powerful earthquakes, said Iran’s environmental protection chief.
When it comes to cyber security Mohammad-Javad Mohammadizadeh, Iran’s environmental protection chief, said Iran’s defenses against cyber attacks were as good as any country’s and its facilities well protected.
RELATED STORIES
Shamoon Mitigation Strategies
Iran Offshore Platforms Targeted
Stuxnet Older than We Think
Cyber War Stakes Rising
Shamoon Target: Aramco Production
Stuxnet Hit 4 Oil Companies
Iran behind Shamoon Attack
Iran’s uranium enrichment facility at Natanz was the first publicly known target of a computer virus used to attack and industrial control system.
The Stuxnet virus, developed by the United States and Israel, ended up discovered in 2010, although researchers at Symantec Corp. uncovered a version deployed two years earlier.
The West suspects such sites see use by Iran to develop a nuclear weapons capability. Tehran says it nuclear program is purely for peaceful means.
“Obviously we have very well managed to protect ourselves from such cyber attacks in not only nuclear facilities and establishments for nuclear power production but also oil and gas and also hydropower as well as the banking network and we have very well protected our system and our information,” Mohammadizadeh said.
“We have developed locally the knowledge of counteracting such cyber attacks and we have very well mastered it,” he said. “Up to now we have always had success in countering such attacks and we expect to continue to do so.”
A senior U.S. Air Force official told reporters in January that Iran responded to the 2010 Stuxnet attack by beefing up its own cyber capabilities, and would be a “force to be reckoned with” in the future.
Mohammadizadeh likened cyber security to protecting one’s health, with a need for preventive and protective steps.
“The issue of protecting against cyber attacks is not in a standstill situation. It will always be on the move and progress further to ensure a safe environment,” he said.
In terms of physically protecting its power infrastructure, Iran’s only nuclear power reactor at Bushehr was unscathed when a strong earthquake that killed 37 people and injured 850 hit close to the site last month, Iranian officials and the Russian company that built it said.
But that has not stopped fears about safety in a country that sits on major fault lines, especially as Iran’s Atomic Energy Organization said more reactors would go there, just hours after the earthquake.
“Most of the energy producing utilities — including all our power plants, being hydropower or even nuclear — they do comply with the minimum of 8, up to about 10, on the Richter scale for resistance to earthquakes,” said Mohammadizadeh.
“The highest known levels of safety and environmental standards have always been observed and incorporated during construction and after the commissioning phase,” he said in a Reuters report.
Mohammadizadeh, also vice president, said Iran was aware of the risks from earthquakes and landslides, which he said applied equally to its hydropower dams.
“Some of the dams we have well over 3 billion cubic meters of water right behind the dam. Imagine what kind of catastrophe a leakage or destruction of the dam could impose,” he said.
Wednesday, April 24, 2013 @ 08:04 AM gHale
By Gregory Hale
Visibility of control system data remains a top priority for refineries these days as the entire enterprise needs to see what is going on throughout the process.
“We are constantly getting pressure to get the data as visible and transparent as possible to a variety of different groups,” said Jason Bottjen, manager of control systems engineering at Valero Energy Corp., during his talk Tuesday at the PAS Technical Conference in Houston.
RELATED STORIES
PAS: Human Reliability
Firms Don’t Budget to Protect IP
Manufacturing Most Attacked Industry
Simulated Attacks Hike Security Awareness
While some of the early talks were visionary and dealing the way things could and should be, Bottjen talked about some of the ways things are in refineries today.
With a boatload of different systems installed within the refineries, Bottjen said there are challenges to ensure plant reliability and safety.
Some of those challenges are:
• Control system challenges
• Management of complex automation systems
• Complexity of open systems and legacy systems
• Cyber security
• Control loop performance
One of the important things he has to deal with is the traceability of data and figuring out which pieces fit together.
When talking about the cyber security challenge, Bottjen said they had to deal with intrusion detection, inventory of cyber assets and physical and network access.
In addition, control loop performance always becomes an issue with underperforming loops, loop tuning and high operator interactions.
“Tuned loops mean greater productivity, which lead to greater profitability,” Bottjen said.
He also said operators need access to information to make informed decisions, especially when it comes to alarms and alarm management.
“Proper alarm management is a key for plant reliability and safety,” he said.
Operators, he said, need greater data visualization so they need to see data with more meaning.
One of the constants that never changes, Bottjen said, is the idea that “things change and that makes this a never ending process.”
That is why to improve reliability, everyone must strive to continuously improve and upgrade the process and manufacturers need to invest in new technologies to solve challenges, he said.
“We need to demystify the black box,” Bottjen said. “We need to increase visibility into the system.”
Tuesday, March 26, 2013 @ 01:03 PM gHale
By Gregory Hale
It has become abundantly clear cyber security is now a vital area for any manufacturing automation company moving forward.
“We are now aware of what has been going on under our noses for years,” said Joe Hogan, chief executive of ABB Ltd. during his keynote address Tuesday at ABB Automation and Power World in Orlando, FL. “We have to bring systems together.”
RELATED STORIES
CA Utility on Attack Alert
243 Days to Discover Attack
New Wave: Risk-Based Security
Survey: Database Security too Complex
Hogan was talking about some trends occurring in the industry and cyber security was one that stuck out. He also talked about the potential growth and strength the North American market is showing after a period of downtime.
“We are optimistic that this is a great place to be and we remain optimistic on its growth potential,” Hogan said. “I am more optimistic about the North American market than I have been in years.”
Enrique Santacana agrees. The North American president and chief executive of ABB said during his talk that he remains very bullish on what the region has to offer. After showing some of the downsides or what he called “headwinds,” Santacana also gave the upside, or “tailwinds.”
He said some of the “headwinds” deal with China, which continues to experience slow growth. “We need a healthy China to continue our growth.”
In addition, he said Europe is still in recession with high unemployment and the Middle East remains unstable.
Then he talked about the U.S. “What can we say about the U.S.?” Santacana said.
The sequester is in full force, there is a potential government shutdown, the debt ceiling debate, regulation overload, persistent high unemployment and the monetary policy. All areas that have the potential to burst the U.S.’s economic bubble at any point.
“It is like a bad movie that you see over and over again. It is like ‘Ground Hog Day,’” he said. He then went on to talk about the disappointment in just how the government is (or is not) working to help alleviate the problems. “It is a sad story when politicians cannot change.”
Hogan added while Washington may be in disarray, there are states out there that are promoting and ensuring growth.
Santacana agreed saying while it is easy to dwell on the negatives, there is a bright future for the industry. “Here in North America we have strong and healthy tailwinds,” he said.
“The housing sector is getting stronger and is enjoying a renaissance,” Santacana said. He also added manufacturing, mining, oil and gas, all requiring productivity, automation and energy efficiency, are continuing to grow, which plays right into ABB’s power and automation hand.
Yes, the economy is far from perfect and yes there are some strong detriments working against it, but there are also policies and plans and place to force the country to move forward in a positive manner.
“There is short term uncertainty facing our business,” he said. “We will need to proceed with caution.”
The growth of technologies and automation in general are also spurring some of the growth of the North American market.
Automation opportunities that didn’t appear 10 years ago are now possibilities, Hogan said. That is where one of the pillars of ABB’s future comes into play: Disruptive opportunities. “These are opportunities that change the fundamentals of the marketplace. There used to be islands of automation out there, but if you put technology over the top you are able to see things, anticipate things and optimize.”
“It is a rebirth time in North America,” Hogan said.
Thursday, February 28, 2013 @ 03:02 PM gHale
There is a new online career-simulation platform that lets students and jobseekers check out careers in cyber security and gain exposure to the skills they’ll need.
LifeJourney enables cyber security companies to become role models for millions of students and others interested in understanding careers across the industry. Using the LifeJourney platform, companies can showcase their talent and transform their technologies into virtual experiences.
RELATED STORIES
Summer Cyber Institute a Success
Automated Testing of SCADA Protocols
DHS, IAEA Ink Collaboration Pact
Black Hat: Govt. Unplugged
Users can experience “field trips,” that lets them live a day in the life of an actual cyber security professional. The platform released at the RSA Conference 2013 in San Francisco.
Careers in cyber security are growing and will not go away as more and more sophisticated attackers, hackers, spies, and cyber criminals steal technology, money, innovation, and intellectual property. The United States government has said there is a shortage of skilled workers and they want to work alongside private companies to create and nurture positions for the cyber generation.
“Cyber security is one of the most important missions in the U.S. today. Building the cyber generation will require educators, government agencies and companies to align their education and workforce development efforts in innovative new ways,” said Robert Rodriguez , chairman of the Security Innovation Network (SINET). “We need to give students, returning veterans, and other jobseekers a way to engage with our industry.”
There are now 50 cyber security LifeJourney modules available, each representing a cyber security career. A company can choose to represent an entire career, or it can use its products and specialized expertise to create field trips that bring important facets of the industry to life. There are hundreds of possible cyber field trips a company can present, showcasing fields and topics like digital forensics, advanced persistent threats, mobile application security, cloud security, reverse engineering, critical infrastructure protection, and many others.
Every LifeJourney offers a series of connected interactive learning activities designed to expose students to the real life skills and challenges for each career.
Depending on the LifeJourney, field trips might be online scavenger hunts, watching video programs, participating in technology training, solving puzzles, or sometimes using real interactive simulations.
Tuesday, February 26, 2013 @ 02:02 PM gHale
Malicious software downloaded by offshore oil workers incapacitated computer networks on some rigs and platforms, exposing gaps in security.
Some of the infected files — featuring pornography or music piracy, for example — downloaded directly through satellite connections, while other malicious files came aboard on laptops and USB drives infected on land.
RELATED STORIES
Stuxnet Hit 4 Oil Companies
FL Utility Suffers DDoS
Hacks Hit Big Firms
Worm Elevates Detection Techniques
Data Breaches Take Months to Find
Oil rigs, like any major organization or company, have a target on their backs and need to develop a defense in depth program that can ward off or isolate attacks that could injure the network.
“The tide is slowly rising and incrementally making things better, but the exposed area is really so high that it’s not really fast enough to limit the risk,” said Misha Govshteyn, co-founder of Alert Logic, a network security company, in a Houston Chronicle report.
Malware infections have occurred at several offshore rigs and platforms, knocking some offline, security professionals said.
When infected devices connected to isolated networks, the malware spread and created problems. One instance, on a facility in the Gulf of Mexico, caused a system to lock up, Govshteyn said. “They literally had a worm that was flooding their network, and they’re out in the middle of the ocean.”
Other infections have had similarly disruptive effects, though none has involved a malicious attack that has had safety repercussions, security professionals said.
Jack Whitsitt, principal tactical analyst for the National Electric Sector Cybersecurity Organization, said in the same report a typical malware infection on energy infrastructure would likely cause no serious problems. But he said a tailored attack, engineered to target a facility through widely distributed malware, could have dangerous repercussions.
Is that just a scare tactic as many have employed over the years? If companies understand how Stuxnet propagated throughout the industrial control system at the Natanz nuclear enrichment facility in Iran, then it would be very easy to understand how an attacker could get into a system control an offshore platform.
With enough knowledge of a facility like an oil platform, refinery, or pipeline network, a cyber attack that used distributed malware could lead to physical damage, Whitsitt said.
If there is a targeted attack, preventing malware from getting onto a network is almost impossible, but a solid defense in depth portfolio will help focus on the attack and allow the user time to thwart the onslaught.
A Department of Homeland Security update in January said 40 percent of the intentional cyber attacks last year targeted energy infrastructure.
Wednesday, December 12, 2012 @ 01:12 PM gHale
Even after all the reported attacks and threats, utilities still view security as a cost center and remain challenged to allocate security funding beyond compliance minimums.
But there is progress, according to Pike Research’s Smart Grid Industrial Control System Security report on the smart grid.
RELATED STORIES
Malware Intensity on Rise
Attack Growth Next Year
Major Security Pain: Mobile Devices
New Year Threat Forecast
Moving at a snail’s pace, the discussion of ICS security among utilities, vendors, systems integrators, and public regulators is more common now.
Along those lines, the market for smart grid ICS cyber security will reach $369 million in 2012 and grow to $608 million by 2020, according to the report.
Utilities as a group appear better informed of cyber risks to their grids and substations. Operations teams are better aware of cyber security issues and expect vendors to understand how their grids operate before they will discuss any purchases, according to the report.
Services engagements are more common than one year ago, which could mean more cyber security deployments within the next one to two years. However, the level of education varies from one utility to the next, with driving the dialogue while others ask open-ended questions such as, “What do I need to do to secure my distribution grid?”
Security providers that specialize in control systems security remain optimistic – they are receiving more requests for proposals (RFPs) than ever and have a great deal of work. In contrast, general-purpose security vendors take a mixed view of the market, with some vendors not yet seeing growth.
Vendor approaches to the market also vary: Some strategically propose a full cyber security solution for an entire control network, while others take a more tactical approach and propose only solving specific problems. Whether taking a strategic or a tactical approach, security providers must orient their discussions with utilities around solving operational and business problems, not technical concepts.
Technology innovation for smart grid ICS security remains stagnant, the report said.
One vendor said, “For the past three years, I have seen the same vendors at every conference, giving the same presentations.” The selection of products available today is sufficient to secure a control system. However, more innovation would be welcome, especially in the areas of threat management and staff efficiency.
The main obstacle to secure control systems is simply the will to allocate enough budget to achieve a secure environment. Despite the improved awareness, utilities remain challenged to allocate security funding beyond that needed for compliance minimums.
“The shallow growth curve for ICS cyber security through the remainder of the decade reflects utilities’ historically measured approach to technology upgrades—the focus on reliability trumps any abrupt shift to the next great thing,” said senior research analyst Bob Lockhart.
“Despite the improved awareness of potential threats and risks, many utilities remain reluctant to allocate security funding beyond that needed for compliance minimums,” he said. “That will change as the technology improves, prices go down, and the cost of complacency becomes more apparent.”
Wednesday, November 14, 2012 @ 10:11 PM gHale
By Gregory Hale
Want to create the better mouse trap? Just ask the students at the New Orleans Charter Science and Mathematics High School.
Creating a better mousetrap was just one of the activities that went on for a group of 60 high schoolers Wednesday at the ChemInnovations 2012 Conference and Exposition in New Orleans. Honeywell Process Control sponsored Project Genius, which showed high school students the benefits of choosing a career in engineering.
RELATED STORIES
Summer Cyber Institute a Success
Automated Testing of SCADA Protocols
DHS, IAEA Ink Collaboration Pact
Black Hat: Govt. Unplugged
As one of the featured presentations, students listened to a talk on cyber security, along with a discussion on the opportunities an engineer can enjoy throughout a career. Students also participated in a few exercises that allow for stronger communication and the coup de grace was a security endeavor on how to build a better mouse trap.
Competition was tough and fierce, but in the end Team Platypus prevailed with their new and improved version of how to capture an unwanted intruder.
The students came into the convention center from the New Orleans Charter Science and Mathematics High School, which is an inner city school that actively recruits students where selective schools might turn away. This school is a model of success as it has 72% of students eligible for free or reduced-price lunch, and they have a 93% graduation rate.
Ronnie Villarreal, director Americas, South East Asia and Pacific Engineering Automation and Control Solutions at Honeywell Process Control, talked about some of the best engineering innovations.
He mentioned the Wright brothers creating flight in Kitty Hawk, NC, the engineering ideas behind roads and bridges, Thomas Edison creating the light bulb, technology that can clean water and make it drinkable, and the telephone among other inventions.
“These were all technologies that changed the world and they were devised by engineers,” he said.
“Today the whole world is changing again,” Villarreal said. “Technology is changing very quickly. We are seeing a convergence of information technology with the process control industry.”
In terms of the growth in technology, Villarreal said just look at the Internet. “There are over 500 million users on the web today.”
Steve Zarichniak, applications consultant at Honeywell Process Solutions, also talked about the pure joy and fascination of being an engineer.
“I am an engineer and that is all I wanted to be. I don’t need to be the boss, I just want to be an engineer. I wanted to be an engineer ever since the space program became popular in the 60s. I just enjoy working on things.”
Technology is one thing, but some of advantages engineers can enjoy is traveling to different regions of the world to work on projects.
Villarreal said he worked on projects in California, in Canada on the oil sands, Mexico, Brazil, Argentina, Amsterdam, and the United Kingdom. “I have done projects in South Africa, where we have the largest implementation of our equipment, but they needed to modernize.”
“I will be traveling to Australia, Singapore, Thailand, and Malaysia in the coming year and I will be going to do some work in China,” he said.
The long and short of it, he said, is “engineers are needed all over the world.”
With the Baby Boomers becoming closer to retirement, these students are in the driver’s seat for job stability in the coming years.
“Fifty percent of engineers are eligible to retire in the next couple of years so there are jobs available. There just are not enough engineers,” Villarreal said.
Plus these students have a leg up on the old timers as they have grown up with technology.
“As graduates, high school students with your technology background already, you have the kind of knowledge built in that will get you ahead,” he said.
But as the day went on it all came down to how well students could work with each other and while under deadline pressure, creatively come up with a design and then execute the building of a mouse trap solution.
Among the hushed discussions at the seven different tables of competition, students worked to come up with a winning idea.
Villarreal was impressed.
“I saw one group collaborate and share a plan. I saw another group that did a very good job early on in project management, but didn’t follow through. There was another group that everyone chimed in ideas and they picked the best ideas and it all came together. I saw another team that worked in shifts. I saw one other team that finished early and cleaned up their mess, which is an important safety function; that is something we think about a lot in the process industry.”