Phil Tonkin

SCADA Cybersecurity Your Practical Defense Playbook After 3 decades in industrial controls, I've seen SCADA systems evolve from isolated workhorses to connected, vulnerable targets. Your SCADA system is a target. The Four Deadly SCADA Vulnerabilities You Can Fix Today Legacy Systems Running on Borrowed Time: That Windows XP HMI you've been nursing along? It's a ticking time bomb. Unpatched systems are low-hanging fruit for attackers. Quick Win: Inventory every piece of software in your control network. Anything without vendor support gets isolated or replaced. Protocols That Trust Everyone: Some industrial protocols send commands in plain text with zero authentication. It's like leaving your front door wide open. Watch Out For: Any industrial protocol traffic crossing network boundaries without encryption. Attackers can read every command and forge new ones. The IT/OT Bridge That Became a Highway: Connecting control networks to corporate networks creates direct attack paths. The Oldsmar hacker exploited poorly secured remote access. Rule of Thumb: Never allow direct IT/OT connections. Use industrial firewalls, an industrial DMZ, and, if needed, data diodes for one-way data flow. Remote Access Convenience vs. Security: TeamViewer, VNC, and similar tools are security nightmares. Shared passwords, direct internet exposure, and always-on connections invite attackers. Your Defense-in-Depth Action Plan 1. Network Segmentation (The Purdue Model): Segment your network into security zones. >>> Level 0-1 (sensors, PLCs) stay as isolated as possible.  >>> Level 2 (SCADA masters and HMIs) gets limited access.  >>> Everything above level 2, like corporate networks, stays separate or connects through an industrial demilitarized zone (DMZ). 2. Access Control That Actually Controls >>> Implement Multi-Factor Authentication (MFA) for ALL remote access >>> Use role-based permissions, operators view data, engineers modify logic >>> Kill shared passwords immediately 3. Monitor What Matters: Deploy ICS-aware intrusion detection systems. Set up baseline monitoring, when pump pressures spike at 2 AM, you need to know why. 4. The Human Firewall: Train operators to recognize cyber incidents as process anomalies. That unresponsive pump might not be a mechanical failure; it could be a cyberattack. The Bottom Line The Oldsmar incident was stopped by an alert operator, not sophisticated cybersecurity. Most attacks succeed through basic failures: weak passwords, unpatched systems, and poor network design. You don't need a million-dollar security budget. You need disciplined execution of fundamentals. Remember: in industrial cybersecurity, availability and safety come first. But unsecured systems won't stay available long. The attackers are already here, make sure you're ready. If you want to go deeper, I've got a video on my YouTube channel with more detail. Check the link to my channel in my profile.

251

30 Comments

When hackers target water systems, the stakes are nothing less than community safety. Cybersecurity isn’t optional—it’s leadership in action. This is where utilities must focus now. Explore my latest blog on building cyber resilience: https://lnkd.in/eFqtAd99  #CyberSecurity #WaterSector #InfrastructureSecurity #NIS2

66

2 Comments

Ensuring robust connectivity for Point IO modules necessitates a systematic and technical approach to configuration. Below is a concise breakdown of the critical steps involved in configuring the IP address, aimed at preserving a secure, private subnet, while facilitating access for maintenance personnel: 1️⃣**Initial Configuration via BootP**: Initiate the IP assignment process using Bootstrap Protocol (BootP). This method allows for precise control over the dynamic IP assignment, ensuring each module is seamlessly integrated into the network infrastructure. 2️⃣**Power Cycling for Configuration Updates**: Following any modifications to the module, it is imperative to perform a power cycle. Executing a disconnect and reconnect of the power adapter guarantees that any configuration changes are fully implemented and recognized by the system. 3️⃣**Manual IP Configuration through Thumb Wheel**: In scenarios requiring rapid reconfiguration or immediate swaps, the thumb wheel on the module serves as an invaluable asset. This feature permits the physical setting of the IP address without reliance on external devices, enabling personnel on site to swiftly adjust configurations—a critical advantage during periods of operational downtime. 4️⃣**Connectivity Verification via Ping Test**: Conducting a ping test serves as an effective method to verify network connectivity. This additional verification step ensures that the module is responsive and properly integrated within the network parameters. Adhering to these procedural steps enhances troubleshooting efficiency, minimizes setup duration, and empowers teams to rapidly address connectivity challenges. Reliable connectivity extends beyond mere device activation; it encompasses providing teams with the necessary flexibility to adapt to dynamic operational environments. By implementing these strategic configurations, organizations can streamline their network management processes, ultimately elevating the reliability and responsiveness of their automation systems.

101

7 Comments

SCADA, PLC, and RTU, as OT components, are at the heart of energy, manufacturing, and transportation infrastructure. However, with the expanding attack surface brought by IT-OT convergence, the risk of data loss and physical damage in critical infrastructure increases. The attached study provides a summary of OT cybersecurity fundamentals, past attack examples, and the latest defense approaches—from Zero Trust to AI-based threat detection—along with an overview of global standards. Additionally, current trends in SCADA security include: • AI and Machine Learning for anomaly detection • Zero Trust Architecture • Blockchain for secure event logging • Digital twins for attack simulation • Lightweight encryption for resource-constrained devices • AI-driven incident response systems

41

Data Breaches Hurt, But Operational Disruption Threatens Survival Most organisations either forget about operational technology (OT) altogether or try to secure it by applying IT controls that don’t fit. But OT isn’t just another extension of IT. It’s directly linked to revenue creation and keeping the lights on (sometimes literally). The challenge is that many companies don’t have visibility of: • Which processes are critical to operations and safety • The systems and suppliers those processes rely on • How quickly they can recover if those systems are taken offline When IT goes down, you can often work around the breach or restore from backups. When OT goes down, operations stop. That’s when the losses escalate from inconvenient to bankruptcy. The recent Jaguar Land Rover cyber incident shows this well. Plants were forced offline globally, dealers couldn’t register cars on launch day, and supply chains stalled. Analysts estimate the company is losing £72 million in revenue and about £5 million in profit every day the shutdown continues. If production doesn’t normalise until November, the total hit could exceed £3.5 billion in sales. The lesson is protect what is critical. Organisations that can’t map, monitor, and secure their OT environment are effectively blind to their biggest revenue risk. OT resilience needs the same boardroom attention as financial performance, because in many industries, it is the single factor that keeps money flowing and services running.

34

3 Comments

The 62443 family of standards includes a broad range of documents. This ebook aims to reduce the complexity of interpreting and applying 62443 for power generation applications. ➡️ https://bit.ly/4pu5iUv Here is an explanation of each part of 62443, along with considerations for applying them to power generation: General (62443 1-x): This part lays the groundwork by defining terms and concepts. It recently added a document to create profiles for specific targets (as a technical specification) but none have been released. Policies and Procedures (62443 2-x): This part provides general guidance on procedures, such as patch management. However, it needs a fair bit of interpretation to apply effectively to networks and systems with safety and critical infrastructure reliability implications. System (62443 3-x): This part focuses on system-level cybersecurity evaluations. It revolves around conducting risk assessments and implementing controls to mitigate identified risks. It also introduces key concepts such as zones and conduits which are widely adopted in OT cyber security practice. Components (62443 4-x): This part focuses on certifications - evaluating the cybersecurity robustness of industrial control vendors and automation products. These standards assess the ability of these products to withstand cyberattacks.

51

9 Comments

In a recent interview with Help Net Security, Cindy Segond von Banchet CC, Cybersecurity Lead at Yokogawa, delves into the essence of a robust OT security program. She distinguishes between quick fixes and enduring resilience, emphasizing the importance of integrating OT security seamlessly into broader risk frameworks, highlighting the significance of addressing vulnerabilities in legacy systems and merging OT operations with existing SOC functions. Crucial aspects like enhancing visibility, providing comprehensive training, and ensuring alignment with established global standards such as ISA/IEC 62443 are also discussed. For organizations seeking to fortify their OT security posture, a roadmap towards building a sustainable and mature program that can withstand the evolving threat landscape is essential. Contact Yokogawa Australia & New Zealand #OTcybersecurity

34

1 Comment

"Just because you're in compliance doesn't mean you're secure." Ashley Shirley The most compelling/scariest session of day 2 of OT SCADA CON was by far the session that Ashley gave on Cybersecurity. My takeaways from her session: 1. Compliance ≠ security 2. Security should be integrated into design, maintenance, and operational workflows. 3. Collaboration between OT, IT, and security teams is essential for effective implementation. 4. Default credentials and internet-exposed devices are major vulnerabilities. 5. Security culture is critical and should be promoted across all organizational levels. Connect with her, and let her help you, no matter where you are in your cybersecurity journey.

49

2 Comments