Industrial control systems seen as 'undeniably vulnerable'
Congress is focusing on securing the nation's critical infrastructure
Computerworld - WASHINGTON -- The Department of Homeland Security and the private sector still haven't developed a comprehensive strategy for securing the real-time control systems that manage much of the nation's critical infrastructure, according to the chairman of a House subcommittee studying the issue.
In a hearing yesterday on the security of Supervisory Control and Data Acquisition systems, which are used to manage infrastructure such as the electric power grid and oil and gas pipelines, Rep. Adam Putnam (R-Fla.) said the lack of a national strategy to deal with SCADA system security makes the nation "undeniably vulnerable" to cyberterrorism.
Putnam is chairman of the House Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census.
"The more I've learned [about the lack of SCADA system security], the more concerned I've become," said Putnam. "I've learned that today's SCADA systems have been designed with little or no attention to computer security. Data are often sent as clear text; protocols for accepting commands are open, with no authentication required; and communications channels are often wireless, leased lines or the Internet."
The hearing was the second held by Putnam to look into the security of SCADA systems. At yesterday's hearing, the General Accounting Office released a detailed study of SCADA system security that Putnam had requested. In its report, "Critical Infrastructure Protection: Challenges and Efforts to Secure Control Systems," the GAO concludes that the DHS hasn't moved as fast as it could to work with the private sector to improve SCADA security.
James F. McDonnell, director of the Protective Security Division at the DHS, told Putnam and other lawmakers that it's his job to coordinate both physical and cyber security for more than 1,700 facilities identified so far as containing critical national security infrastructure systems. Of those facilities, 565 contain SCADA systems that must be protected.
McDonnell outlined a series of physical security efforts, such as site security assessments and buffer zone protection mechanisms, underlying the DHS's current strategy for SCADA security. Amit Yoran, the director of the DHS's National Cyber Security Division, "looks at the ones and zeros," said McDonnell, adding that he and Yoran are still developing a "joint" physical and cyber protection plan.
Yoran wasn't present at the hearing.
According to McDonnell, the National Communications System (NCS) is currently working with the Idaho National Engineering and Environmental Lab to conduct communications modeling and simulation of SCADA systems, known as the National SCADA Test Bed. The NCS has initiated a study of vulnerabilities in the natural gas pipeline system throughout the eastern U.S. Other efforts are under way to identify the
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!