Re: Anyone catch the ISS "SCADA Terrorism" talk BH Federal yesterday?

[Jan Muenther <jan.muenther () nruns com>]

Hello Matthew,

> It seems pretty weak, at least based on what is in the slides.  A bunch of
> folks from the Middle East download an ISS whitepaper, which proves there
> are threat agents we should care about?
>  
I concur to a certain degree, yet on the other hand a full-fledged risk 
analysis would require some serious recon and terrorists typically don't 
much enjoy being spied on, thus they're quite reclusive with information 
on whatever they're planning.
One might argue the ISS guys sound a little overly paranoid here, but 
I'd personally consider it naive not to think about the impact attacks 
on civil infrastructure through terror cells can have. In my opinion, a 
heads up in this direction is long overdue.

It's rather ironic, really:
While  some candy makers who sell their stuff online protect their 
infrastructure like Fort Knox, vital pieces of civil infrastructure are 
basically sitting ducks (I can only speak for the pieces of Europe I've 
personally seen this in - not too sure about the US, I know e.g. in the 
energy field there are efforts being made, last not least due to the 
lessons learned from MS Blaster, I guess). I do a lot of pen testing, 
and the level of nonchalance I've seen in e.g. transportation or 
telecommunications can be frightening.

Anyhow, I'd safely assume terror organizations consider these attack 
vectors - they're not all undereducated towelheaded peasants from the 
mountains of some godforsaken country. The sheer fact that it's possible 
to cause severe damage and attract a lot of attention makes them 
attractive.

> How was the talk perceived? Folks running out to buy generators after seeing
> the demo? Fear of taking the Metro home?
>
>  
I don't think that's the message the authors intended to transport. But 
if a little bit of public attention generates the pressure it takes to 
raise security in civil infrastructure to a half-sane level, I'm 
supportive.

Cheers,
Jan