If OT could just get the basics straight. Even an actual DMZ works wonders.
Yet here I was baking agreements with cell co’s in 2011 for private networking on 3G/4G mobile devices. Meanwhile critical infrastructure just sits on whatever.
It has to do with budget. Where I'm at we have plenty of budget for cypruscurity.
Yeah, the lack of updates for OT equipment is manufacturing is so prevalent we put every machine in its own DMZ that can't communicate with the internal network.
Stop hooking up everything to computers & the internet, fucking hell.
As somebody who sells cyber security to IT leaders, it is laughable how exposed these kinds of places are and once you make them aware of it, they repeat they don't have budget
HOPEFULLY this stuff will move the needle in water in terms of baby’s first cyber hygiene. Although CARR didn’t really, maybe bc it’s an actual foreign adversary things will be different. God knows we need NERC CIP-water edition badly. Not like this admin will either create or enforce new regulations though
"Vendor needs remote access"
People asked for transparency in their water systems. Considering things like flint Michigan it makes sense. But overall these are likely nation state based actors and they will find a way which is why geopolitical discussions are also critical to cybersecurity discussions.
Lack of internet access usually means lack of updates, visibility, & security controls. But in cases like this where they might not even know what a security control is, an air gap would be a good stop gap. Stop gap air gap if you will
I don't see the need to have the functional pieces in these plants automated outside of the plant. Sure, monitor all day long, but people have to be physically there all the time anyways...they can't watch for alerts and go hit buttons?
I wouldn’t exactly call it “easy” to prevent. No internet access means visibility, updates, packages, etc all become a lot more difficult to do. Not *impossible* of course, but not “easy”. If it was easy, then they probably would’ve done it.
If you’re going to hook them in, you have to do it responsibly. Controls between the DMZ and the OT environment, that detect unwanted or malicious traffic. We need stricter physical controls to where these PLCs live as well.
Just going off what I read and people I know in that industry, it sounds like this was just grossly negligent setup. Open ports directly to the PLCs with either default or easy to guess passwords. Multiple utilities hit, same area, reads to me like a vendor did the install and "that's the way we done it at other utilities..."
Yeah agreed - Purdue has been around for 30 years; no excuses.
Def use the same admin passwords across the board and probably never rotated. Hunter2
This is pretty much standard for local government. Trust and believe this isn't a solely Minnesota issue. Security in local government infrastructure is an after thought.
And yet this keeps happening. Why on earth are critical resources like these so much as legally permitted to be on public networks? I hate the concept of “regulate everything” but the reality of ignorance and complacency forces it.
If only you knew how bad utility companies across America were ran… sheesh
That’s exactly what happened.
It also wasn’t just Minnesota was several other states.
This was a bog standard “What not to do in cyber security issue.”
Agreed but also not shocked in the slightest.
I sold a SIEM solution and the number of hospitals and power infrastructure that were compromised were ridiculous. This was 8-10 years ago... Medical devices talking to China was a big one
The simple fact that they can't tell whether it was Iran or an employee goof already proves the setup is negligent
Question should be why weren’t they using the Purdue model for this?
All respect to my water homies but these people have never heard of the Purdue model unless you’re working for a BIG water utility. They are at the point where they have ICS plugged into the actual internet, they are not what we’d call sophisticated cyber defenders
Would love to work at a utility company on ot and overall cyber. too bad it's so hard to break into that industry
I dunno know...maybe now is a good time to send them your resume. 🤔
"so hard to break into that industry" apparently not
I’m sure it was just like every industry where info sec puts in written policies about changing vendor passwords and then the silo’d sysadmins totally ignore it and run accounts of operator / operator and admin / admin.
Putting vital systems only with gomer pyle admins what could go wrong!
And Wisconsin and several other mystery states.
I thought Tim Walz did it from his basement?
Guy I know that works at GE aerospace was telling me their plc support is based in india for his plant an they remote into to the plcs. All to save the American dollar.
the thing that has been warned about for decades has finally happened
The horror.
Honestly wouldn’t doubt this is our federal government
Yikes.
SCADA has been an open target since the 1990s. The software was old even then, and most of them are on the open internet contacted by modems Funny fact, most telephone switches are still contacted on a 300 baud modem & routes and services are uploaded via text files. How do I know this? I was setting up the communication computers for the phone company, and I was told that 90% of most phone equipment is 20-30 years behind. New stuff gets added for business & all the equipment there gets shoved down to the neighborhood phone networks
A lot of those water guys do some hard dckriding on SCADA, and I can't help but think they're backwoods idiots. Those guys will double down on it, like they've never heard of Six Sigma or anything with standards and processes. Got some of em in my family, too. It's kinda pathetic.
"Muh SCADA"
New NERC CIP cyber scecurity regulations incoming in 3...2...1. Because 650 pages wasn't enough.