How SCADA/ICS Security Sausage is Made

And like regular sausage making, the process is not always pretty to behold. The company whose computers were targeted by the Stuxnet worm has been working hard on solutions that will better protect its customers going forward. But as in any arms race, it's up to antagonists to show the company is question hasn't done enough yet, or isn't moving fast enough, or both.

In the cyber security business, fortunately, some of the best opponents are faux opponents. Such seems to be the case with NSS Labs' Dillon Beresford (LinkedIn profile). This from today's darkREADING Advanced Threats page, on a presentation that didn't happen in Texas:

In posts to the SCADASec security mailing list, Beresford noted that while he is free to give his presentation at any time, he'll wait until it's safe to do so given the potential ramifications. He said in a post today that "until the products are fixed and the patches have been carefully validated the presentation will remain out of the public domain. As for a definitive timetable on patches, who knows..."

The full article is HERE. Thanks to the established dynamic of this industry, with crack penetration testers challenging suppliers to show they've made necessary security fixes, the truth will out. And eventually, sooner or later (hopefully sooner), utility asset owners will have SCADA/ICS systems that are harder to hack.