Supervisory control and data acquisition (SCADA) generally refers to controlling and monitoring the process by using a computer system.
Process may be public/private which includes water treatment and distribution, waste water treatment and disposal, oil & gas pipeline, electrical power transmission, civil defense alarm, air, road, rail traffic airports, buildings, ships and even space stations.
Every one knows the importance of the process which we are talking; it’s a life line for a public, a small mistake in the process will results a huge loss of life and damage to the property.
Do the people while designing the system, really consider of all the possible situations and consequences which can occur and the ways to prevent the loss?
One important thing to be considered, is securing the system both physically and through cyber media.
Damage may occur either physically that is a person enters into the premises and steal or damages the property.
Or entering into the system through the internal network or by internet to take control of the system and use it for terror or any illegal activities.
While considering a system it is necessary to design a security plans to stop & control intruders physically and through cyber media.
Stopping/Controlling physical securities can be done by integrating electronic security systems with various technologies using video surveillance, perimeter securities, intrusion detectors, access control systems. And even by manned securities.
Cyber attacks; is more dangerous because by remotely the whole system can be taken controlled and exploited.
For example in water industry, what an attacker can do if he compromises a scada system is he -Can interfere with the operation of water treatment equipment; chemical over or under-dosing, disable service, reduced pressure flows of water into fire hydrants, or overflow of untreated sewage into public waterways, block data or send false information to operators to prevent them from being aware of conditions or to initiate inappropriate actions, change alarm thresholds or disable them completely, Lockout access to system accounts etc.
Although many facilities have manual backup procedures in place, failures of multiple systems may overtax staff resources - even if each failure is manageable in itself.
Stopping and controlling the cyber attacks should be done by IT team but majority of scada projects are being handled by scada instrumentation and automation industries without much exposure to IT part. This kind of situations arises vulnerabilities which gives chance to attack.
The problem is scada professionals are not strong in IT and IT persons are not strong with scada systems
The system can be done hack proofed only when both IT and Scada professionals work together.
Stopping and controlling terror activities for avoiding threats; security industries should come up with different types of solutions like manned securities, electronic securities and IT securities. This can definitely add value to public and private safety and avoidance terror attacks.
History of attacks on water plants
SALT River Project SCADA Hack
A 12-year-old hacker, exploring on a lark, broke into the computer system that runs Arizona
Roosevelt Dam holds back as much as 1.5 million acre-feet of water, or 489 trillion gallons. That volume could theoretically cover the city of Phoenix Arizona capital, the rampant Salt River would spend most of itself in a flood plain encompassing the cities of Mesa and Tempe
The unauthorized intrusions resulted in direct costs of $13,000 in clean up costs for the sewage spilt and $176,000 in extra monitoring and security of the system. It also resulted in an extensive and costly in-house investigation, extensive media activity, and a loss of Maroochy Water Service’s reputation over a five month period.
Maroochy Shire Sewage Spill
"Marine life died, the creek water turned black and the stench was unbearable for residents," said Janelle Bryant of the Australian Environmental Protection Agency.
Trojan/Key logger on Ontario Water SCADA System ;
A key logger/Trojan gives control of the system through which a person having control can do anything like he may changes chlorine & alum dosage, operate valves etc.
Viruses Found on Auzzie SCADA Laptops
Software Flaw makes MA Water undrinkable :
Audit/Blaster Causes Water SCADA Crash
DoS Attack on Water System via Korean Telecom
Penetration of California Irrigation District Wastewater Treatment Plant SCADA
SCADA System Tagged with Message, "I enter in your server like you in Iraq.“
SCADA Breach in Harrisburg, PA by an external hacker
Feb 2009 highly evasive Conficker/Downadup worm infects 12 million computers, stealing information. – BBC
Jun 2008 "Security Hole Exposes Utilities to Internet Attack" - Associated Press
SCADA vulnerability...control software used by one-third of industrial plants. - SC Magazine
Mar 2008 Emergency 2-day shutdown of Hatch nuclear plant from software update on one business computer.
Jan 2008 Hackers turn out the lights in multiple cities and demand extortion payments." - Associated Press
Sep 2007 DOE Idaho
Sep 2007 Hackers compromise Homeland Security computers, moving information to Chinese websites. – CNN
Jul 2007 3Com's security division demonstrates how SCADA system flaws can be exploited.
Nov 2007 "Insider Charged with Hacking California Canal
Aug 2007 "Hackers Take down the Most Wired Country in Europe " for two weeks. - Wired Magazine
Jan 2006 Homeland Security Conference - SCADA systems are vulnerable to intrusion. – UrgentComm
10-June-1999 an "Olympic Pipe Line" company faced the rupture and release of gasoline causing damages of at least $45m
Pradeep Madgaonkar
Pradeep Madgaonkar
