In the last 30 years, major advances have been made in both SCADA technology and security. Yet, somehow, the security of SCADA systems has changed very little. Even though SCADA systems are deployed all over the world – with the number of current deployments trending consistently upward, security has not been a primary concern of the software engineers. There are a number of reasons that could be cited, but the primary one relates to the ways that the software is being used. Frequently the same SCADA software can be used to automate various types of processes, from water treatment and power distribution to building automation and energy management. Furthermore, SCADA customers who have invested numerous hours into designing and implementing their systems however many years ago are not especially excited about the idea of making the sweeping changes that would be required to make the systems more secure. Basically: “If it ain’t broke, don’t fix it”.
The problem with this philosophy is that – when it comes to security – many times the system is “broke”. Just because a system has not fallen victim to an attack doesn’t imply that it’s not vulnerable. And once an attack has occurred it will likely be too late to “fix it”.
The Legacy of Stuxnet
When the Stuxnet worm was discovered in 2010, it called attention to the scope of the potential danger inherent in attacks on SCADA systems. Though Stuxnet is a very sophisticated worm created by sophisticated minds with virtually unlimited resources at their disposal, it is a plain fact that if a group or organization is sufficiently motivated there are very few (if any) barriers that cannot be overcome.
The fact that some very sensitive and necessary processes are currently controlled by some sort of SCADA software – from electrical grids to mass transit systems – an effective attack could be absolutely devastating. For this reason there are some very legitimate concerns.
I.T. departments are frequently tasked with designing and implementing the security parameters of SCADA systems – not an easy task since a functional SCADA system relies on easy accessibility. If it is not easy for multiple people to access multiple data points at any given time, the SCADA system is not going to be effective, and it could in fact be dangerous. So, it is often a delicate balancing act to make a system simultaneously accessible and secure, and it would be naïve to not think that some security is compromised for the sake of accessibility.
SCADA in the Cloud
The latest conversation as it relates to SCADA and security centers around cloud-based deployment of SCADA systems. The inherent dangers of cloud-based deployment are well-known and well-documented, so I will leave it to the reader to ascertain the details. Suffice it to say that terrestrial SCADA systems have not be thoroughly secured against all attacks, so I think it’s safe to assume there are some valid security concerns associated with publishing operational data to the cloud. That’s not to say it won’t be happening; it almost certainly will. When cloud-based SCADA becomes the norm, you can be fairly certain that a whole new array of security concerns will surface. The good news is changes in technology will eventually force users of older SCADA and HMI systems to strongly consider upgrading. And when that happens, let’s just hope they make security a top priority.
New Ideas In Security
Scada developers at B-Scada have integrated some new security features into their latest software product, Status Enterprise Edition. Status will allow users to be assigned to specific roles with access limited according to the permissions of the role – something like user groups in Windows. Additionally, specific aspects of the SCADA system wil be organized into Workgroups. Users will be limited to accessing the assets and information that have been made available to the workgroup(s) to which their role has access.
This allows for easy enforcement of essential security principles such as the Principle of Least Privilege, and restrict users accounts to the least amount of information rewuired to do their jobs.
It will be possible for organizations to divide access to key data among multiple personnel, so that no one person can access everything at once; this will make it very difficult for unauthorized parties to make any potentially dangerous changes to the SCADA system without the support of multiple people on the inside.