Game of Phones

Apple iOS 7 will be released next month, and it's time for us to once again declare our allegiance to our feudal technology overlords.  Overlords that are starting to feel remarkably like those from the popular HBO TV show.

Blackberry is House Stark.  Solid, loyal, dependable, secure and dead.  Their only hope are their bastard offspring.

Android is House Lannister.  They have spent many years behind the scenes manipulating the empire, and have only recently seen the opportunity to show their power openly.  Technologically dominant, and masters of strategy, they are sure they can think their way to the top, and then hold it.  Security comes through threat, rapid change and the culling of the weak.

iPhone is House Targaryen.  They have come from out of the wilderness and they have dragons, an ancient mystery that has not been harnessed by anyone in living memory.  They also have a sexy leader, and everyone emotionally wants to get behind them.  But after the initial revelations at the end of the first season, there really hasn't been anything new for the last two years.  Security comes through central control and fervent loyalty of the followers.

Windows is House Baratheon.  They were once dominant, but time has passed them by, and internal bickering stops them from really being a force any more.  Because they have ruled in the past, they believe they have the absolute right to rule in the future.  Security isn't a concern, only survival, but only the most loyal followers expect anything other than a spectacular crash.

The thing to remember is that the only winners in the Game of Phones are the main houses.  If you are a peasant or vassal - and in reality we all are - then the best we can do is raise our flag in support of one of the main houses, and hope they don't sacrifice us for their greater good.

Until then, enjoy the ride.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com 

Why no-one gets SCADA security right

SCADA is an acronym for Supervisory Control and Data Acquisition.  That's a bit of a mouthful and unless you've studied Engineering it's not clear what it means, so here's a simple definition: SCADA is computer controlled physical processes.  The common examples given are power stations and water treatment plants, but it's much more than that.  Building management systems that control the temperature, lights and door locks: that's SCADA.  The production line at a large bakery that makes your bread: that's SCADA.  The baggage system at the airport that loses your bags: that's SCADA.  The traffic lights that annoy you on your drive to work: that's SCADA.

It's everywhere.  It's all around us.  And it's all implemented badly.  Maybe that's too strong - it's all implemented inappropriately for the threat model we have in 2013.

We have to set the way back machine to the 1980s to understand why we are in the mess we are today.

Traditionally SCADA systems were designed around reliability and safety.  Security was not a consideration.  This means that the way the engineers think of security is different.  In IT security we consider Confidentiality first, then Integrity and finally Availability.  This matches with our real world experience of security.  But in SCADA systems it's the other way around - Availability first, then Integrity, and finally Confidentiality a very distant third.

There are two very good reasons for this approach.

Firstly: Keeping SCADA systems running is like balancing a broom stick on your finger - you can do it, but it takes a lot of control, and if you stop thinking about it, the broom stick falls.  This is the fundamental reason that the dramatic scenes where the bad guy blows up a power station as shown in movies just can't happen.  If you mess up the control the power stations stops generating power, it doesn't explode.

Secondly: Every business that controls real world processes has a culture of safety: they have sign boards telling how many days since the last lost time injury, and are proud that the number keeps going up.  Anything that gets in the way of human safety is removed.  That's why control workstations don't have logins or passwords.  If something needs to be done for a safety reason, it can't be delayed by a forgotten password.

All of this made perfect sense in the 1980s when SCADA systems were hard wired analog computers, connected to nothing, staffed by a large number of well-trained engineers, and located in secure facilities at the plant.

That isn't true now.  Today SCADA systems are off-the-shelf IT equipment, connected to corporate networks over third party WAN solutions and sometimes the Internet, staffed by very few over-stressed Engineers, sometimes not located even in the same country.

So what happened in between?  Nothing.  Really.  SCADA systems have an expected life of about 30 years.  The analog computers were replaced by the first general purpose computers in the late 1980s, and they are only now being replaced again with today's technology.  They will be expected to run as deployed all the way to 2040.

I hope you've stocked up on candles.

Phil Kernick Chief Technology Officer
@philkernick www.cqr.com