- 15 Non-Certified IT Skills Growing in Demand
- How 19 Tech Titans Target Healthcare
- Twitter Suffering From Growing Pains (and Facebook Comparisons)
- Agile Comes to Data Integration
Network World - SAVANNAH, Ga. -- The security associated with industrial control systems (ICS) is facing heavy criticism this week at the ICS Joint Working Group 2012 Spring Conference, sponsored by the U.S. Department of Homeland Security (DHS). DHS is concerned cyberattacks could disrupt America's energy, water and manufacturing facilities.
But DHS is also taking concrete steps to improve ICS through a joint effort that includes Motorola Solutions, DHS and Israel's National Information Security Authority -- the Israeli government agency tasked with protecting its critical infrastructure. Together, under what's called the "Secure Controller Joint Project," it has led to Motorola coming up with the security-hardened ACE-3600, which was unveiled today at the conference.
"We live in a tough neighborhood in the Middle East with our neighbors," said Erez Kreiner, director of Israel's National Information Security Authority (NISA), speaking today about the development of Motorola's ACE-3600. He noted there had been more than a few attempts by attackers to take control of ICS systems in Israel in order to try to wreak harm.
ICS systems are typically not known for good security, and in fact, Kreiner said he's even aware of industrial controllers that shipped with viruses inside of them, sardonically calling it "virus-added technology from the vendor."
But DHS, Motorola Solutions and the Israeli government are hoping Motorola's ACE-3600 raises the bar for security in ICS. Israel's NISA has just completed the testing and certification of it for use in Israel, and in the U.S., Idaho National Lab is reviewing it as well. Motorola Solutions product manager Kobi Levin said Motorola expects to begin selling it in June.
The ACE-3600 is a souped-up ICS that does a lot of what ICSs do not do today in terms of security, including working with an authentication server for secure user-access control and role-based permissions. It can encrypt data at rest and in transit, log security events, has secure programming to avoid back doors, has an integrated IP firewall, and uses McAfee whitelisting technology to make sure no unauthorized applications are added to the console. The RTU controller itself doesn't have a way to use whitelisting yet, but McAfee is working on that, says Levin.
McAfee, the security company that's now part of Intel, today also presented a security approach for ICS-based networks used in plants and manufacturing, which increasingly have some way to access the corporate business networks that have Internet access, which heightens risk.
Eric Knapp, director of critical infrastructure markets at McAfee, noted that it's not feasible to run antivirus software for a controller because of the CPU consumption. But other controls, such as whitelisting, which restricts unauthorized applications, can be used on consoles, for example. McAfee is working on some security products especially designed for use in the ICS environment.