Hackers have targeted water systems in several US states in a coordinated cyberattack that has caused some utilities to issue boil-water notices and switch to manual mode, taking their systems offline, according to US officials.
A lot of our critical infrastructure is connected. From power generation to water to sewer. All have been subject to hacking attempts, some successful.
I have also been saying for quite a long time that these things should not be connected in a way that they can be damaged or disabled by internet.
But y’know, put it all on the web and write controller software for centralized remote operation and monitoring so you can fire people and run the system with less people for more profit.
I’m willing to bet that there are a core of talented systems engineers that built out the control systems for water plants. They are smart people that care deeply about what they do.
Their “leadership” however is usually made up of a loose group of interchangeable clowns that cycle in and out based on connections, nepotism and financial incentives. Their job is to do stuff to impress other important people and that usually means cutting costs. Sometimes it means getting into bed with a vendor or other company so they can profit from the relationship.
They will direct the engineers to use stupid shit, turn off controls, use platforms that are wholly inappropriate.
They will make a mess out of a system that was designed well to the point where fixing all the problems is impossibly expensive. They will declare that its good enough and then take their next job.
I have watched this cycle happen over and over. Current company has about 10+ years of problems stacked up and it would cost more to fix them than the company makes in revenue for a few years. They won’t be fixed.
When it comes to SCADA systems they should never be connected to the internet and should be air gapped to prevent intrusions. If connecting from a remote location it should be secured with a VPN, 2fa and be read-only. SCADA systems are almost constantly monitored 24/7 and someone onsite should be able to handle any emergencies
A lot of our critical infrastructure is connected. From power generation to water to sewer. All have been subject to hacking attempts, some successful.
I have also been saying for quite a long time that these things should not be connected in a way that they can be damaged or disabled by internet.
But y’know, put it all on the web and write controller software for centralized remote operation and monitoring so you can fire people and run the system with less people for more profit.
Ooh I do security stuff.
I’m willing to bet that there are a core of talented systems engineers that built out the control systems for water plants. They are smart people that care deeply about what they do.
Their “leadership” however is usually made up of a loose group of interchangeable clowns that cycle in and out based on connections, nepotism and financial incentives. Their job is to do stuff to impress other important people and that usually means cutting costs. Sometimes it means getting into bed with a vendor or other company so they can profit from the relationship.
They will direct the engineers to use stupid shit, turn off controls, use platforms that are wholly inappropriate.
They will make a mess out of a system that was designed well to the point where fixing all the problems is impossibly expensive. They will declare that its good enough and then take their next job.
I have watched this cycle happen over and over. Current company has about 10+ years of problems stacked up and it would cost more to fix them than the company makes in revenue for a few years. They won’t be fixed.
When it comes to SCADA systems they should never be connected to the internet and should be air gapped to prevent intrusions. If connecting from a remote location it should be secured with a VPN, 2fa and be read-only. SCADA systems are almost constantly monitored 24/7 and someone onsite should be able to handle any emergencies