TVA Security Lapses Could Endanger US Health, Economy 46
coondoggie links to a Network World story about myriad security flaws (described in a report from the Governmental Accountability Office) at all levels of the Tennessee Valley Authority, the country's largest public power utility, excerpting: "The Tennessee Valley Authority (TVA) is a federal corporation that generates power using 52 fossil, hydro and nuclear facilities in an area of about 80,000 square miles and has not fully implemented appropriate security practices to protect the control systems used to operate its critical infrastructures, the GAO concluded. TVA's corporate network infrastructure and its control systems networks and devices at individual facilities and plants reviewed were vulnerable to disruptions that could endanger a good portion of the country's economic security and public health and safety, the GAO said."
The TVA is hardly alone, though, when it comes to governmental computer security. Reader bc90021 points out the Federal Government's newly released Computer Security Report Card (prepared for Congressman Tom Davis), which "breaks down the agencies and assigns them all a grade. There are plenty of Fs, not the least of which is for the newly reconnected Department of the Interior."
Re: (Score:1)
Well no wonder (Score:5, Funny)
They'll get it done, just give them a chance to catch up on their e-mail and slashdot first.
Re:Well no wonder (Score:4, Funny)
Um - why? (Score:5, Insightful)
Re: (Score:2, Informative)
In other cases, the particular control system could just be a digital switch for a breaker for line X. Sure, it's no more complicated than a big switch, but those 245kV lines tend to be pretty inconvenient to trip.
Re:Um - why? (Score:5, Insightful)
Problem with that method is that there was no incentive to make upgrades to infrastructure and systems under regulation. ZERO. Which has lead to the situation we are in now: We have a first world nation with a third world electric power grid. Costs are rapidly rising, power demands are increasing (thank the internet for that), and the equipment is starting to get so old it can't be replaced anymore.
So now, utilities are finally starting to look at way of improving their business. This means more data needs to flow from teh plant into other areas of the business. That data can be used to plan maintenance upgrades, to cost out fuel, to improve efficiency, to add green power to the mix, etc. Connecting these plants and control centers to each other provides a valuable service, it's just that utilities didn't know jack about securing them.
To put it mildly, a generation plant can save $100,000 - $1,000,000 a year simply by sharing data with optimization consultants on a real-time basis. That's what we call "easy money". And in the absence of federal regulations, that's what they did. Now though, utilities are required to secure their network, most under the NERC CIP standards. Situations like TVA's are going to become very very common in the next few years, and then they are going to simply go away as utilities get the message that security means greater electric reliability.
~Sticky
/I've spent the past 3 years of my life working in SCADA security, and plan several more.
Re: (Score:1, Interesting)
An example: The industry has been moving, for years now, towards TOU rates (time of usage). This requires upgrading manually-read meters to meters that automatically upload their usage data. This saves utilities money in the long run because you don't have
Re: (Score:3, Insightful)
However, data collection and retreval should be on a completely separate network from the power plant's critical control systems. They're unrelated tasks; one requires strict reliability and security, while the other doesn't need to be any more secure than the typical business network.
More to the point.... why the hel
Re: (Score:2)
Because, in case you haven't noticed, while these systems are custom designs, we still need to maintain compatibility with COTS hardware and software. For example, which would you rather purchase? Belden 9860 Twinaxial cable? Or CAT5?
There are also issues of training. Which would you rather test for? Profibus? or an Ethernet cable tester? You can get a well trained monkey to do the Ethernet testing. The Profibus tests, however, might prove a bi
Re: (Score:2)
It' not a question of not speaking TCP/IP, it's a question of not randomly connecting separate networks together. Share data all you want, just collect it with one machine on the control network and hand it (via serial) to another on the business network.
Re: (Score:3, Insightful)
You're right about unnecessary remote access. Even on a local network though, you don't let everybody on the network have access to the control systems. Most, if not all, the things mentioned in your quote apply to local networks, too.
If I had my druthers, I would also pull out the floppy, CD and DVD drives and the USB and Firewire ports as well. Viruses, trojans and malware don't just come in over the Internet. I would also not have wi-fi. Just like with cell phones on airplanes, there may not be any chan
Re: (Score:2)
Re: (Score:2)
Thankyou - not!
Geez man, get off our backs! (Score:4, Funny)
Yeah, I live in Chattanooga... (Score:5, Interesting)
More about "The Bunker" it has bedrooms, conference areas, and a whole slew control panels, and server farms. The employee that was with me and I left there and on the way back to my business we were like "If we were the bad guys we could have just caused major mayhem. Needless to say I returned again a couple of months later on a job and instead of just walking in, I got a M16 clad officer at the door. I would think their security is likely better now.. At least I *hope* it is.
P.S. I hope they don't come after me for telling this.
Interesting. (Score:2)
Re:Yeah, I live in Chattanooga... (Score:4, Interesting)
I lived in Chattanooga for about 12 years. Somewhere around 1998 or 1999 I visited the exact place you are talking about with a friend of mine (who was then and still is a TVA IT employee). I was just becoming interested in computers at the time and he told me that he would show me where the TVA kept "the brains" of their operation as he put it. Even at that time I questioned whether or not he could get me into this area and his reply was "nobody will know and even if they did nobody will care".
I went back to Chattannoga to visit my old friend a couple of years ago. He had since moved up the govermental ladder and was more or less "in charge" of certain systems. During my visit he took me back to the place, on a Saturday. There was a single security guard on duty at the entrance. As we entered the guard didn't give us much notice as my friend swiped his ID card and entered a key code. I was holding my friend's laptop bag and the guard never asked to look at it or see it. For all he knew I could have been carrying in a brick of explosives. Once inside, I had access to pretty much any place in the "bunker" that I wanted to go, including various control panels, servers, etc.
Short answer, no their security is not better than it was back then.Re: (Score:1)
+5, Comfortable lie
SCADA Security Sucks (Score:4, Informative)
Watch out for the inside guy. (Score:4, Insightful)
Re: (Score:2)
SCADA and other such networks for operating industrial equiptment exist in open-source form, so secure reference implementations would
80,000 square miles? (Score:2)
Re: (Score:2)
Of course when you had building parking lot and other infrastructures need, it will be more then 8500 Sq. Miles.
Can that 80,000 mile be correct? 1000 miles wide and 80 miles long?
I'm sure it's not shaped like that, I was just using those numbers to get the area in my head.
Re: (Score:2, Informative)
All we need to do is clear off every structure in those 8,500 square miles, and we're golden!
I don't think that TVA's facilities actually occupy 80,000 square miles (that would be ridiculous). I believe their service area is 80,000 square miles. http://www.tva.gov/sites/sites_ie2.htm [tva.gov]
This is not a new problem (Score:5, Interesting)
I had a large utility administration customer back in the early 90's. Back then I was constantly shocked (pun intentional) about how vulnerable our power distribution system really was. And the weakest links were frequently the most lightly protected. I even started drafting a novel about a small group of terrorists able to take down the power grid on the entire west coast for months and the effects on society of such an extended outage.
Hopefully grid security is better now, but there's still a lot of lightly protected hardware that will remain difficult to harden.
Ever since then I've kept a 4 Kw generator and extra gas, just in case. Even though I've only needed it a few times in all those years. Our power grid is surprisingly reliable. So much so we tend to take it for granted.
Re: (Score:2)
Months? how the hell do you do that? days, sure.... a week in really bad weather, but months? I can't see that happening.
FYI (Score:3, Insightful)
Nothing seems to be happening... (Score:1)
Re: (Score:1)
There is no effective solution. (Score:2)
Note to the NSA: I am not a terrorist, please don't take me away.
Criteria?? (Score:3, Interesting)
I work in IA for the DoD, and there is a lot of stupid stuff that happens, but in the end, the number of minor security incidents is very low, and the number of SERIOUS security incidents is absolutely minuscule. Serious incidents are usually along the lines of information leakage, someone inside doing something stupid without malicious intent.
my point being, this isnt a signal that these departments are insecure because they dont show WHAT theyre grading. are they counting serious incidents? minor ones? number of missed security deadlines? number of workstations with wsus errors? number of MWR personnel that clicked on an exercise phishing link? what??
lots of directives in the government are lists of objectives with deadlines next to them created by a higher-up that doesnt understand any part of it. i am not discounting this "report" entirely, but iv seen this enough times to understand how little it could actually mean, especially considering there is no information provided.
I wonder how much of a stink Tom Davis is going to raise in congress about it, or if he is going to look at it and understand that it tells him nothing.
No Worse than the Bushit Administration (Score:1)
I don't see how it could be any worse than what the Bushit Administration and Repugnicants have already done to national security and the economy. (Oh and I guess we should blame some of those do-nothing Demoflats too)
SHHHH! (Score:1)