Archive for the ‘SCADA’ Category

Bugtraq: C4 SCADA Security Advisory - Rockwell Automation (Allen Bradley) Multiple Vulnerabilities in Micrologix 1100 & 1400 Series Controllers

Friday, January 15th, 2010

Bugtraq: C4 SCADA Security Advisory - OSISoft PI Server Authentication Weakness

Wednesday, September 30th, 2009

SCADA Security

Friday, January 11th, 2008
What's SCADA? SCADA is an acronym for Supervisory Control And Data Acquisition, and it refers to software and hardware that is used to monitor and control industrial processes. What kind of industrial processes? Everything from bottling soft drinks to nuclear reactors. Not only are SCADA systems important to protect from accidental damage, but in the hands of black hats (or terrorists) seriously Bad Things (tm) could happen. SCADA systems are generally not designed with security in mind, mainly because they are deployed in stand-alone networks, not connected to the rest of the corporate network and definitely not the Internet! Right? Wrong. They were deployed like that, but due to cost-saving measures (and likely employee boredom) these networks are connected to the Internet indirectly through a company's corporate network. They save money by not having to lease dedicated lines to each site, and can instead hook up a DSL or cable modem, install a VPN concentrator and they're off to the races. Secure networks should be isolated using network "air gaps" (i.e. unconnected) from the rest of the corporate network. Yes, that means Slim Jim controlling the hydroelectric dam can't look at gay porn while he's opening floodgate #7. Ok, bad mental picture. Yes, it's inconvenient (sorry Jim), but the cost of convenience is that worms, viruses and black hats now have access to these networks, and by transitivity, access to the nuclear reactor. Having fun yet?