SCADA Security: Why is it so hard?

SCADA security and advance persistent threats have now taken center stage. While the industry has some success in dealing with IT security, when it comes to industrial control systems or SCADA systems, we still have enormous challenges. This session will discuss why implementing SCADA security is so difficult, and discuss strategies to meet these challenges. I will discuss my experience working with large organizations with control system installations, and present how SCADA security can be deciphered.

The session will include:
- A very brief technical introduction to SCADA and industrial control systems
- SCADA systems under the hood, including SCADA protocols like MODBUS and DNP3 at the packet level
- Attacks on RTU, PLC, HMI, FEP, SCADA slaves and master stations
- Real world examples of successful and not-so-successful implementations of securing control systems and SCADA systems.
- How to use security tools, technical solutions and a change in mindset to address SCADA security
- Pointers on using the free open-source SCADA scanning tool

This presentation will help organizations trying to implement security measures for their controls systems and SCADA systems. It identifies hurdles that organizations face and will help avoid them, from mistakes made by others. It will help attended try out some tools and techniques when they get back from the conference. It will also help security vendors as well as vendors of SCADA systems to align their solutions to achieve a common goal. For attendees who are not familiar with in-depth SCADA security, the presentation will be an excellent introduction and fast forward to effective SCADA security implementation.