More About Cloud-Based SCADA Systems

Our recent Cloud-Based SCADA Systems webinar was well attended right up to the end of the presentation, which highlights the tremendous interest in this topic. I have a few more comments I'd like to make to amplify the webinar.

Other Resources
There are many informative books available on the subject of cloud computing such as The Cloud at Your Service by Rosenberg, Cloud Computing for Dummies by Hurwitz, and many others (see listing here). Furthermore, the Homeland Security News Wire website has a wealth of information on this topic.

Security
This is largely a matter of how well a system is planned and implemented. There is no such thing as 100% guaranteed security in-house or in the cloud, though obviously, in-house is more under your control and is afforded better protection under the law. IT security techniques and practices have evolved over many years and need to be applied to SCADA and MES systems just as they are applied to front office systems. This is especially true for cloud deployments. We have developed Ignition with this in mind so you can leverage proven, standardized IT security practices.

Latency
We discovered this the hard way with a system where the Ignition server was 3,000 miles from the PLCs and clients. This wasn't exactly a cloud system but rather a WAN for a large company.

The elementary math principle of zero times any number is always zero says all. When you press a button in a SCADA system to start a pump there are many transactions involved. Client to server, server to PLC, PLC to server, and server back to client. Also, each of these has handshaking involved which involves more trips. Each leg has its own latency and variability of latency.

When the latency is very low as in a local network, the effects are usually negligible. When there are hundreds of milliseconds of latency in each leg, the accumulative effects can be intolerable. And the variable effects of latency can cause a system to look unreliable.

The Patriot Act
Data located on your physical premises is treated very much differently than your data in the cloud. You should see the Patriot Act Hang-up in the Cloud post by Michael Overly on this matter. This post gives some insight to a question asked by one of our webinar attendees. You should also check out the Forrester Research Cloud Privacy Heat Map for international cloud privacy information. Remember that when you host in the cloud, the hosting server could be located anywhere in the world.

Reliability
Every company will need to answer the question, "How much downtime can I tolerate?" for themselves and then decide accordingly whether off-site hosting makes sense or not. One company decided "no worries – we have redundant ISPs" only to have both providers go down for the better part of a day.

I hope these comments are useful. Some of the questions that were asked at the end of the webinar were intriguing. I will try to answer some of the questions in subsequent posts.

Stuxnet and Common Sense

The Stuxnet PLC/SCADA virus saga keeps getting deeper. If you haven't been following the story, you can read this Wikipedia article about it. The Wikipedia article skirts around what the ultimate objective of the Stuxnet virus is but this AOL News article minces no words.

It's all very interesting, but essentially the virus exploits various software vulnerabilities and thereby modifies the PLC program that controls high frequency VFDs found only in uranium enrichment centrifuges. Its purpose, according to the AOL article, seems to be to over-speed the centrifuges momentarily so as to destruct the rotational parts.

I have just one question, why wasn't the PLC program password or keyswitch protected against program changes? In a sensitive application like this, why not? Control system security is mostly a procedural and implementation issue. Yes, network traffic should be encrypted. Yes, user authentication should be centrally managed along with other IT applications. But no matter what, any system can be compromised when common sense goes out the window.

Common sense is important and there is no one-size-fits-all solution. I see it just like a personnel safety system implementation. A risk assessment for the situation is done and vulnerabilities are evaluated, then an appropriate solution applied. And it is a continuous improvement process that adapts the system to new conditions as discovered.

In a safety system risk assessment the first step would be to determine, in a worst case scenario, what the loss would be. Death? Personal injury? Machine damage? Product damage? And in the latter two, how much cost? Similarly, you would first do a risk assessment for SCADA or PLC security. In fact, the parallels between a safety risk assessment and security risk assessment are uncanny.

The recent TSA enhanced pat-down for pilots is an example of the one-size-fits-all mentality when it comes to security. I sure hope it doesn't come to that for SCADA systems. The right answer is to approach SCADA security the same way safety has been approached in our industry for many years.