In 1995, I ran a small program on critical infrastructure security for electric utilities. THIRTY YEARS ago. A lot of our efforts were focused on keeping the power on with the upcoming Y2K, but much effort was focused on protecting SCADA systems and open modems at substations. I left the industry a few years later and I’m constantly reading and re-reading and re-re-reading the same old recycled stories about cyber threats to critical infrastructure.
Same.
Most of these SCADA systems were installed by integrators who were the low bidder and did what they were required to do by contract. I’d bet at least 8 out of 10 municipalities lack the knowledge of cybersecurity to write a proper spec and the people who sign their paychecks (i.e. city councils) don’t know the difference and won’t spend the money to hire experts that can inform them. Everyone wants these systems to be accessible from the internet because that allows them to save money vs. having to send someone out to remote sites with a laptop and serial cable.
The only surprising thing is that we’re not seeing more such attacks every day.
And STILL nothing is done about it.
I warned about this a decade ago.