Understanding Network Threat to Industrial Infrastructures

SCADA (supervisory control and data acquisition) generally refers to industrial control systems (ICS): computer systems that monitor and control industrial, infrastructure, or facility-based processes, as described below:

Industrial processes include those of manufacturing, production, power generation, fabrication, and refining, and may run in continuous, batch, repetitive, or discrete modes.
Infrastructure processes may be public or private, and include water treatment and distribution, wastewater collection and treatment, oil and gas pipelines, electrical power transmission and distribution, wind farms, civil defense siren systems, and large communication systems.

Facility processes occur both in public facilities and private ones, including buildings, airports, ships, and space stations. They monitor and control HVAC, access, and energy consumption. _Wikipedia SCADA

SCADA YouTube Tutorial
SCADA systems control large sections of modern industrial infrastructures, and are often connected to the public internet. This makes them susceptible to hackers, some of whom would like nothing better than to hold a city or a corporation hostage, via its water or power supply etc. Even worse, in case of international hostilities, a foreign powers may threaten an opponent's vital infrastructure as a routine part of negotiations over trade treaties, economic pacts, or cooperation agreements.

A SCADA sends instructions to shopfloor machines like pumps, valves, robot arms and motors. But such systems have moved from communicating over closed networks to a far cheaper conduit: the public internet. This can give hackers a way in. Eric Luiijf of TNO Defence and his colleagues found a litany of insecure "architectural errors" in the waterworks' SCADA networks (International Journal of Critical Infrastructure Protection, DOI: 10.1016/j.ijcip.2011.08.002).

Some firms did not separate their office and SCADA networks, allowing office hardware failures, virus infections and even high data traffic to potentially "bring down all SCADA operations". While remote internet access to SCADAs is supposed to be possible only with strict security controls, the researchers found this was often not the case. And some water firms allowed third party contract engineers to connect laptops to their SCADA network with no proof they were running up-to-date antivirus software.

This was compounded by news of the hack at the Texas water plant, where on 20 November a hacker named "prof" gained access to the plant's systems using a three-character default password on an internet-accessed SCADA made by Siemens of Germany. "No damage was done to any machinery; I don't really like mindless vandalism. It's stupid and silly. On the other hand, so is connecting your SCADA machinery to the internet," he wrote on the Pastebin website.

One of PRECYSE's main approaches to securing systems will be "whitelisting", a way of ensuring only authorised users obtain access. This is the opposite of the approach used by antivirus software. "Instead of hunting for malicious code, as in an antivirus blacklist, this only lets the known good guys connect," says security engineer Sakir Sezer at Queens University Belfast in the UK. Unusual behaviour - such as attempting to extract the control codes used to drive equipment - would also mean access is blocked. Deep-packet inspection, normally used to spot copyrighted material on the net, could be harnessed to ensure no attack code is injected.

But it won't be easy. "The biggest risk we face is that of denying the legitimate user access to their SCADA because something in the security setup has changed," says Sezer. "You don't want to create a denial of service attack against yourself."

The systems have other enemies, too. The Stuxnet worm, which attacked Siemens SCADAs in Iran's uranium-enrichment facility in Natanz, wrecked 400 machines. Duqu, a relative of Stuxnet spread in Word files, is currently probing SCADA networks seeking out control instructions.

The battle for the safety of our utilities has only just begun. _NewScientist

The stealthier that a hacker can be when infiltrating an industrial or civic infrastructure, the more deniable is the attack.

Smart industries and cities will begin designing redundant backup systems. They will also look into economical and reliable ways of taking their vital infrastructures off the public networks. Unfortunately, we are entering the age of the Idiocracy, when political correctness, affirmative action, and a faux egalitarianism are all more important than a secure foundation for building a better future.

In other words, hope for the best, but prepare for the worst.