SCADA security

During previous employment, I was responsible for developing IT Security plans for SCADA Systems which led to system certification for operations.

In early SCADA systems the equipment and software was obscure and network exposure to the world was limited. Now, we have systems that are interconnected to other networks making them more vulnerable to attack. My experience has led me to become involved in more than just documentation. I became involved in the "engineering" of the system (including COTS). I kept finding requirements that were not security conscious such as individual who wanted remote access to power systems. In this case not just a user but the vendor wanting access for support. I removed all remote access to the system not only for security but also for safety. Always keep in mind that these are the systems that keep the plant running. All said and done, I used everything I could to protect these systems from using area access control, isolated networks, biometrics, and encryption. Here's a good recent white paper on SCADA Systems:

http://www.sans.org/rr/whitepapers/warfare/1644.php

Hi,

In general all scada systems will be connected in seperate domine and they won't be exposed to out side systems. In general scada system firewalls will be disabled or off mode. The main security they will have is seperate domine. If any body want to take data from scada systems for report purpose or for some other purpose ! Scada systems will expose or give some of the parametes in .XLS format or to ERP systems or though SQL reports etc.

Regards
Ravi.Battula