SCADA Security and the "Most Monumental Non-Nuclear Explosion and Fire"

Click here to receive your FREE subscription to Campus Technology

Home > SCADA Security and the "Most Monumental Non-Nuclear Explosion and Fire"

Current News

SCADA Security and the "Most Monumental Non-Nuclear Explosion and Fire"

4/14/2004

By Terry Calhoun

The answer is simple: While higher education IT managers have been worried about business system-related issues, such as viruses and worms infecting office computers or swamping networks and servers, there's a additional area of cyber security, a hugely important area of cybersecurity, that we've been ignoring, and that's SCADA security. (But if you're like most IT professionals, even most IT security professionals, you've never even heard the word "SCADA" till now.)

SCADA stands for "Supervisory Control and Data Acquisition," and consists of the software, devices, and networks that collectively control the world's power grids, gas pipelines, chemical plants, transportation systems, and other national critical infrastructure.

There's ample evidence that SCADA security is a hot area right now (no gas pipeline-fire-related puns intended); for example, note:

o The General Accounting Office has just released a 47-page report entitled "Critical Infrastructure Protection: Challenges and Efforts to Secure Control Systems," GAO-04-354 (http://www.gao.gov/cgi-bin/getrpt?GAO-04-354 ) this past March, which concluded that "The systems that monitor and control the sensitive processes and physical functions of the nation's critical infrastructures are at increasing risk from threats of cyber attacks" and that improving the security of control systems against cyberattack should be a "high priority."

o The Chairman of the House Subcommittee on Technology, Information Policy, Intergovernmental Relations and the Census, Rep. Adam Putnam (R-FL) has been publicly quoted as saying that the lack of a national strategy to deal with SCADA system security makes the nation "undeniably vulnerable" to cyberterrorism, and that "Today's SCADA systems have been designed with little or no attention to computer security." (March 31, 2004: http://www.computerworld.com/securitytopics/security/story/0,10801,91790,00.html )

We understand that those Washington DC folks are talking about strategic national vulnerabilities, and that you might (perhaps appropriately) wonder whether those "big picture" vulnerabilities are really relevant to us in higher education, as opposed to powerline operators or refinery administrators sitting in some control room. I believe the answer is yes, if only for three reasons:

First, and perhaps most importantly, we should be teaching our students about SCADA security as part of our network security education efforts. There is much we need to learn collectively about SCADA, and while SCADA systems are definitely "their own animal," there are still many lessons from enterprise network security that can be usefully ported to the SCADA arena.

Second, SCADA issues really are something that will be of direct local pragmatic relevance to each of us, if only because each of our campuses have SCADA-controlled and monitored local systems. (You may not know it, but trust me, they're out there).

Third, and perhaps most importantly, we, as opinion leaders, have a burden to shoulder: We need to put SCADA security on the national center stage. If we don't speak up and make sure that folks pay attention to SCADA-related issues, there will come a day when we will collectively wish we had.

Campus Technology

Current News

SCADA Security and the "Most Monumental Non-Nuclear Explosion and Fire"

Recommended Reading

Related Articles

Biweekly Poll

Sponsored Links

Solution Centers

Campus Technology

Registered Users

New Users

It only takes a minute

Current News

SCADA Security and the "Most Monumental Non-Nuclear Explosion and Fire"

Recommended Reading

Related Articles

Events

Current issue

Biweekly Poll

Sponsored Content

Sponsored Links

Solution Centers