<story><title>US passes emergency waiver over fuel pipeline cyber-attack</title><url>https://www.bbc.com/news/business-57050690</url></story><parent_chain><item><author>arkadiyt</author><text>Colonial Pipeline precisely does keep it&amp;#x27;s control network disconnected from the internet - the only thing that was ransomwared is their corporate network. They shut the pipelines down voluntarily to prevent further spread.</text></item></parent_chain><comment><author>mulmen</author><text>If we define critical system as &amp;quot;necessary to the operation of the business&amp;quot; then the corporate system is absolutely critical.  It doesn&amp;#x27;t matter if the SCADA system is airgapped if you can shut down the capability by crashing the corporate systems.</text></comment>
<story><title>US passes emergency waiver over fuel pipeline cyber-attack</title><url>https://www.bbc.com/news/business-57050690</url></story><parent_chain><item><author>arkadiyt</author><text>Colonial Pipeline precisely does keep it&amp;#x27;s control network disconnected from the internet - the only thing that was ransomwared is their corporate network. They shut the pipelines down voluntarily to prevent further spread.</text></item></parent_chain><comment><author>rckoepke</author><text>I built some of the SCADA and IT systems for Colonial Pipeline.&lt;p&gt;Many industrial SCADA systems (nearly all) send data from their &amp;quot;OT&amp;quot; systems (PLC&amp;#x2F;DCS&amp;#x2F;SCADA) to their &amp;quot;IT&amp;quot; and business layers (Historians&amp;#x2F;Timeseries Databases, Dashboards, Power BI&amp;#x2F;etc). This almost &lt;i&gt;always&lt;/i&gt; happens through a two-way link (think TCP&amp;#x2F;IP, HTTP). While the &lt;i&gt;software&lt;/i&gt; should not allow data flow backwards, the hardware absolutely does. So how much do you trust the software?&lt;p&gt;I often advocate that industrial SCADA systems utilize &amp;quot;data-diodes&amp;quot;, one-way opto-isolators, or other &lt;i&gt;physically&lt;/i&gt; verifiable methods of confirming that no information&amp;#x2F;data&amp;#x2F;instructions can get from a &amp;quot;higher&amp;quot; layer (OSI Pi, PowerBI) to a lower layer (Allen-Bradley PLC, Siemens PLC, Emerson DeltaV DCS, etc).&lt;p&gt;Convincing the powers-that-be to do this has been incredibly impossible in most places and a large reason why I&amp;#x27;m trying to transition to a different space - I simply have had ethical concerns about providing engineering services to critical infrastructure without building in best practices.&lt;p&gt;Stuxnet was over a decade ago - I don&amp;#x27;t understand how these protections aren&amp;#x27;t mandated by the DHS already.&lt;p&gt;Disclaimer: I don&amp;#x27;t think it&amp;#x27;s reasonable for non-involved people to assume the OT side has been compromised. I do think Colonial will need some time to verify the integrity of their SCADA systems and it makes sense to keep the power to the physical devices (valves&amp;#x2F;pumps) offline until they do. I understand why they chose to shut down but I don&amp;#x27;t think there&amp;#x27;s any evidence that they&amp;#x27;ll be unable to start back up again.&lt;p&gt;Lastly, I saw a quote in one article:&lt;p&gt;&amp;gt;&amp;gt;&amp;gt; Digital Shadows thinks the Colonial Pipeline cyber-attack has come about due to the coronavirus pandemic - the rise of engineers remotely accessing control systems for the pipeline from home.&lt;p&gt;I strongly doubt this. It&amp;#x27;s possible, of course. But it&amp;#x27;s extremely unlikely to me that employees would have remotely accessed OT&amp;#x2F;SCADA systems from home. No one I&amp;#x27;ve worked with has had that capability enabled.&lt;p&gt;Many companies use products which have been shown to have flaws, like Citrix or various corporate VPNs. These could be compromised to get access &amp;quot;closer&amp;quot; to the OT layers but never directly into it.&lt;p&gt;Onion layer security is very much practiced everywhere I&amp;#x27;ve been.&lt;p&gt;Edit: I have heard of some petrochemical facilities moving towards allowing operators and engineers to manipulate valves&amp;#x2F;pumps on their iPhones. This horrifies me for many reasons. I&amp;#x27;ve never actually seen it implemented and I always bring up Stuxnet when I hear people mention it. I personally believe that DHS should make this sort of thing illegal for critical infrastructure. Many good engineers disagree with me.</text></comment>