POWER December 2012 - 19

Conference Report: 12th ICS Cyber
Security Conference
The 12th ICS Cyber Security Conference was held at Old Dominion
University's Virginia Modeling Analysis and Simulation Center
(VMASC) October 22-25, 2012. There were approximately 150 attendees
from multiple industries, universities, government, and vendors
as well as consultants from the U.S., South America, Europe,
and Asia. The conference used the remote video conferencing capabilities
available at VMASC to enable a few speakers to participate
from as far away as Europe and Asia.
The conference addressed multiple aspects of the vulnerabilities
that affect industrial control systems (ICSs). These are the programmable
logic controllers (PLCs), distributed control systems (DCSs),
SCADA, and other systems that make our modern world function
smoothly every minute of every day by controlling physical processes
in power and water utilities, oil and gas pipelines, chemical and
manufacturing plants, transportation, and defense. These are the
same types of systems that were compromised by Stuxnet.
Conference participants studied case histories and discussed the
progress of standardization and interoperability. No press representatives
were allowed into the conference, and a non-attribution
policy was rigorously enforced, hence the lack of names and affiliations
in this report.
No Consistent Definition
Showing the diversity of interests of those working on cyber security
threats, conference participants could not agree on a single
definition of what constitutes a cyber incident, particularly an unintentional
incident. One very useful outcome of the conference was
developing a better appreciation of the breadth and depth of critical
infrastructure protection (CIP) security required, the wide range of
skills required to solve cyber security problems, and the importance
of sharing information, particularly about unintentional incidents.
ICS cyber incidents caused without intent-failures stemming from
the processing, storage, or transmission of data-can have disastrous
consequences and serve as roadmaps for ICS system hacks.
(For more on ICS protection failures and their consequences, see
" Ensuring the Cybersecurity of Plant Industrial Control Systems " in
the June 2012 issue of POWER, available at www.powermag.com.)
Another key conference finding was that there are few (being
generous) technologies actually developed for ICS that are not recycled
IT solutions. One emerging technology solution was discussed
that could be a game changer because it improves control system
performance and appears not to be susceptible to cyber threats.
However, it is still in the research and development phase, and details
were sparse. Additionally, progress is being made on device
authentication at the protocol level, and some chipmakers are transferring
their know-how to control systems for authenticating end
devices. Protecting product information is becoming much more
common these days (see sidebar).
Many Are Unaware
An international survey performed for CIGRE (the International
Council on Large Electric Systems) identified the lack of cyber understanding
by the control and protective relay community as another
area of work that is currently lagging. This is particularly important
as CIGRE did not address the impact of the Aurora test-a cyber attack
on power generating equipment staged by the U.S. Department
18
Legal Fears Stifle Public Discussion of
Cyber Security Threats
Discussions about technologies used and responses by firms engaged
in securing their cyber systems went in an unexpected
direction at one point during the 12th ICS Cyber Security Conference.
In fact, three events that came to light at the event
demonstrate what appear to be parochial responses to reported
vulnerabilities. Intentionally inhibiting the free interaction and
flow of information between cyber security professionals, particularly
by vendors and the federal government, will only slow future
advances in state-of-the-art ICS security.
In the first situation, two presentations focusing on a nuclear
plant's potential cyber security vulnerabilities were abruptly cancelled
when an equipment supplier threatened to sue the plant
owner. The subject of both talks was the results of a security review
conducted for a foreign nuclear utility, an above-and-beyond
review not required by regulators, but one that the utility voluntarily
pursued. One presentation was to be by utility representatives
and the other was to be by a representative of the utility that
conducted the review. The result of the review identified new and
previously unknown vulnerabilities. Even though the utility had approved
the presentations, the vendor complained it would violate
their nondisclosure agreement.
What the conference participants did learn was that this international
utility's assessment and analysis program is more comprehensive
than what existing U.S. Nuclear Regulatory Commission (NRC)
guidance requires. This raises questions concerning the adequacy
of NRC cyber security guidance and therefore the adequacy of cyber
security programs at all U.S. nuclear plants. It should be mentioned
that representatives of the NRC attended the conference.
In the second case, a firm engaged in cyber security that, according
to an Oct. 29 Reuters report, " uncovered thousands of
pieces of control equipment exposed to online attacks did not tell
U.S. authorities where they were installed because it feared being
sued by the equipment owners. " This quashing of important information
sharing based on the fear of lawsuits brought by vendors is
having significant repercussions across many industries.
Finally, attendees learned that the U.S. government " has kept a
technique it discovered for attacking electricity generation equipment
secret for five years, " according to the same Reuters report,
leaving known vulnerabilities of many electricity generators without
protection. Ironically, U.S. Defense Secretary Leon Panetta,
also in October, said that terrorists could use cyber attacks to " contaminate
the water supply in major cities or shut down the power
grid across large parts of the country. "
The U.S. government is also adding to the difficulty of devising
responses to new threats by routinely classifying critical information
as " secret " and by failing to develop appropriate cyber security
regulations for utilities, according to Kevin McDonald, executive
vice president at security service provider Alvaka Networks in Irvine,
Calif., who says, " If we don't do something as a community, really
bad things are going to happen and people are going to die. "
www.powermag.com
POWER | December2012
http://www.powermag.com http://www.powermag.com
POWER December 2012

Table of Contents for the Digital Edition of POWER December 2012
