Special Reports

By Joe White

Sun May 18 10:04:04 BST 2008

Why the hell would you even link that kind of system to the internet?! Thats just asking for trouble!

REPORT | REPLY

By Nigel

Sun May 18 11:20:55 BST 2008

"Internet"? The articles use of "internet attack" is misleading, it should have said "network attack" and would generally require the industrial LAN which the SCADA uses to be connected to the internet , allowing outside access, something most engineers would / should be loath to do.

Products like Wonderware, RSView, CiTect another SCADA packages are not generally used as the only direct plant control. They are used to give a user view into the status of the plant and generate reports, maintenance fault listings and run on aWindows PC. They are also used to issue high level commands to turn certain sections of the control system from automatic to manual control etc. The actual control of motors, valves, actuators is typically done by dedicated hardware. If you cause the computer running the SCADA program to crash, reboot etc. It is highly unlikely it will issue a positive and correctly structured command during this crash process. What it does mean is that you can't monitor the plant or control using that computer. You can most likely still use other user interfaces that are typically located on the shop floor or near the machinery provided the engineers have properly separated the SCADA and low level comms. Networks. However these sorts of failures can lead to more complex failures due to lack of status visibility in control rooms.

However...since the late '90's there has been a large push to get "global visibility" of such control systems and many people who don't seem to see the risks have been promoting this sort of thinking. IMHO the risks outweigh the benefits because even simple DOS attacks can prevent SCADA systems from working.

At a SCADA conference in 1999 I was surprised by the total cluelessness demonstrated by everyone about DOS attacks and other threats to networks.

A solution is to ensure only authorised computers and authorised people can gain access to your SCADA computer in the first place. We'll all be waiting a long time for highly complex software not to have flaws or weaknesses. How does the cost of a shutdown of a conveniently online accessible site compare to the cost of getting a trusted person physically on site when things go wrong and not running the risk of being compromised?

REPORT | REPLY

By Harsh Kumar Verma

Sun May 18 12:12:51 BST 2008

NS is stupid why do they put this on the i ternet lol a hacker could come and see this what's hte point if we know

REPORT | REPLY