Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

What IT Can Teach Utilities About Cybersecurity & Smart Grids
Newest First  |  Oldest First  |  Threaded View
Page 1 / 2   >   >>
User Rank: Apprentice
5/26/2016 | 3:36:15 AM
Great post awesome info 
User Rank: Apprentice
12/10/2013 | 6:39:22 PM
RBAC part of the solution
When it comes to default passwords, the asset owners need to pay more attention to specifying requirements for Role Based Access Control using Standards such as IEEE 1686.

As far as Ruggedcom is concerened I believe that default password cyber security issues were addressed quite some time ago (12 months + ?) which seems to be a responsible approach.  Not sure what benefit there is in raising an old resolved issue against a select vendor - FUD??

Once decent RBAC is implemeneted by the asset owner, it is then about how do they manage that access to the devices with large numbers of users and large numbers of devices so solutions like the Siemens Ruggedcom Crossbow system comes into play controlling and recording all activity.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
12/6/2013 | 1:53:18 PM
Re: IoT & Smart Grids
Kristopher Ardis, executive director of Energy Solutions for Maxim Integrated, offers some additional perspective in a recent article in SmartGrid News, Smart grid, the Internet of Things and Security, an inside look . Focusing on the similarities between smart grids and IoT, Ardis says smart grid deployments offer several reasons why "security must be designed in from the start" of any IoT deployment, among them:
  • A multitude of remote, distributed sensors and control devices are deployed Iin IoT where they will not be supervised. Unlike an ATM with a security camera nearby, there is no oversight on a smart meter. This makes it easy for an attacker to acquire devices for study.
  • There are risks with machine-to-machine communication. When devices are communicating with each other with little human interaction, tampering may be difficult to detect until something catastrophic happens.

Interesting analogy and food for thought! Anyone agree or disagree?




[email protected],
User Rank: Apprentice
12/6/2013 | 12:19:51 AM
Re: Win 95
Why is Windows ANYTHING running these systems???
User Rank: Strategist
12/4/2013 | 2:00:03 PM
Win 95
I'm not shocked to hear utilities using Windows 95 in critical grid machinery. I was discussing Internet of things strategy with a manufacturing CIO, and he said this is one thing that holds them back -- they have Windows versions much older than 95 running machines, and they don't dare put those on a network.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
12/3/2013 | 9:19:13 AM
Re: A frightening thought!
Totally agree, Stratusician, that these power grid vulnerabilities are really scary. One of the most frightening revelations in the article was that Windows 95 machines still run many critical systems.
User Rank: Moderator
12/2/2013 | 7:35:59 PM
A frightening thought!
What a great wake-up call to one of the lesser known, yet potentially more critical, threats due to the age of cloud and internet.  As the Internet of Things and the push to connect infrastructure to the cloud increases, it's frightening to think of the risk of devastation it brings.  In the worst case, when you consider electronic warfare, these systems could have devastating outcomes.  After all, to think that all nuclear missle launch codes were set to 00000 for the longest time, and the weakness of password security, this is truly a recipe for disaster.  Unfortunately, only a forced revamp of security controls for these systems will help reduce the risks from these threats.
User Rank: Apprentice
11/27/2013 | 3:37:10 PM
External Threats
I found this to be a very insightful article and there is a lot to take away from it. It seems more and more utilities are moving to offline air gaped enviornments to avoid any interaction with the oustide world. Still, the question remains, how do you validate the integrity of files that would enter such a utility via USB from a contractor/vendor/employee, etc?

I would encourage you to read how OPSWAT Security Applications allow you to design security controls which dictate which and what kinds of media and file types are allowed into critical infrastrucute.
Chuck Brooks
Chuck Brooks,
User Rank: Apprentice
11/27/2013 | 10:36:54 AM
Thanks Robert for an excellent article. Our utilities and smart grids are indeed vulnerable and are under attacked more than we are aware. Thankfully, DHS, NIST, and the not-for-profit Council on Cybersecurity have identified this issue of critical infrastrucutre protection as an urgent priority.
Susan Fogarty
Susan Fogarty,
User Rank: Apprentice
11/27/2013 | 9:22:29 AM
Re: Another security threat to keep us up at night
Marilyn, I agree. This is one of those topics that I am surprised doesn't get more attention. Especially now that energy companies are using remote monitoring to measure customer consumption, their networks have become very dispersed. Bob, do you see utilities making moves to hire more people with IT and security backgrounds to help beef up their security postures?
Page 1 / 2   >   >>

I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
The Promise and Reality of Cloud Security
Cloud security has been part of the cybersecurity conversation for years but has been on the sidelines for most enterprises. The shift to remote work during the COVID-19 pandemic and digital transformation projects have moved cloud infrastructure front-and-center as enterprises address the associated security risks. This report - a compilation of cutting-edge Black Hat research, in-depth Omdia analysis, and comprehensive Dark Reading reporting - explores how cloud security is rapidly evolving.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-02-04
A vulnerability classified as critical was found in SourceCodester Online Eyewear Shop 1.0. Affected by this vulnerability is an unknown functionality of the file oews/products/view_product.php. The manipulation of the argument id leads to sql injection. The attack can be launched remotely. The asso...
PUBLISHED: 2023-02-04
A vulnerability, which was classified as problematic, has been found in XXL-JOB 2.3.1. Affected by this issue is some unknown functionality of the file /user/updatePwd of the component New Password Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Th...
PUBLISHED: 2023-02-04
A vulnerability, which was classified as critical, was found in Calendar Event Management System 2.3.0. This affects an unknown part. The manipulation of the argument start/end leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and ma...
PUBLISHED: 2023-02-04
A vulnerability, which was classified as problematic, has been found in MobileDetect 2.8.31. This issue affects the function initLayoutType of the file examples/session_example.php of the component Example. The manipulation of the argument $_SERVER['PHP_SELF'] leads to cross site scripting. The atta...
PUBLISHED: 2023-02-04
A vulnerability classified as critical has been found in OnShift TurboGears This affects an unknown part of the file turbogears/controllers.py of the component HTTP Header Handler. The manipulation leads to http response splitting. It is possible to initiate the attack remotely. Upgrading...