SCADAhacker.com

 

 

SCADAhacker was conceived with the idea of providing relevant, candid, mission-critical information relating to industrial security of Supervisory Control and Data Acquisition (SCADA), Distributed Control (DCS) and other Industrial Control Systems (ICS) in a variety of public and social media forums. Since its launch in December 2011, SCADAhacker has attracted and retained over 10,000 readers and followers from over 50 countries around the world,  making it one of the leading sources for information sharing and knowledge development specifically devoted to industrial security.

The idea is simple - provide a single point of contact for a wide range of readers covering multiple industry segments for everything related to industrial security.

An important aspect of cyber security for critical infrastructure protection focuses on a basic understanding and awareness of real-world threats and vulnerabilities that exist within the industrial automation and control system architectures used in most process industries and manufacturing facilities. These issues face the Distribution Control Systems (DCS) and Supervisory Control and Data Acquisition Systems (SCADA) that comprise most industrial environments, and impact not on the common IT infrastructure like Windows-based computers and network appliances (switches, routers and firewalls), but also embedded "proprietary" equipment such as programmable logic controllers (PLC), remote terminal units (RTU), intelligent electrical device (IED), basic process controllers (BPCS, safety instrumented systems (SIS), operator panels, and ancillary systems that are the basis of most integrated ICS architectures.

On October 19, 2015, PBS NOVA aired a documentary entitled "CyberWar Threat" that included extended discussions with industry recognized experts including Ralph Langner (@LangnerGroup), Joe Weiss, Liam O'Murchu (@Liam_OMurchu), and Kim Zetter (@KimZetter).

The global cyberwar is heating up and the stakes are no longer limited to the virtual world of computers. Now, thanks in part to secret documents released by Edward Snowden, the true scale of the National Security Agency's scope and power is coming to light. Besides spending billions of dollars to ingest and analyze the worlds' electronic communications, the NSA has set out to dominate a new battlefield—cyberspace. NOVA examines the science and technology behind cyber warfare and asks if we are already in the midst of a deadly new arms race. Already, highly sophisticated, stealthy computer programs such as the notorious Stuxnet worm can take over and even destroy the control systems that regulate everything from food factories to gas pipelines, power plants, and chemical facilities—even our cars. While the destruction of Iranian centrifuges may have delayed Iran’s bomb program and forestalled an Israeli attack, the attack has opened a Pandora's Box, and now America's own critical infrastructure is vulnerable to retaliation and attack. With leading defense experts and investigative journalists who have probed the murky realm of criminal and strategic hacking, NOVA examines the chilling new reality of cyberwar in which no nation or individual is safe from attack.

One key objective of the SCADAhacker website is to provide vital information that helps visitors understand and secure ICS systems used within most process and manufacturing environments. SCADAhacker provides visitors with a comprehensive collection of security-related resources including tools commonly used to secure and test ICS architectures, information on the latest threats, vulnerabilities, and exploits that exist for ICS architectures, and a comprehensive library of the latest in standards, best practices, guidelines, and ICS-related information that can be used to help improve the security of any ICS system.

Some of the research performed during work on the second edition of "Industrial Network Security" by Eric Knapp and Joel Langill has confirmed some "eye opening" facts that industrial systems are gaining the attention of not only security researchers, but also potential attackers. Data obtained from the former Open-Source Vulnerability Database (OSVDB) shows that through the end of 2014, more than 85% of all ICS vulnerabilities have been disclosed since 2011 - the year following the discovery of Stuxnet. The OSVDB database tracked more ICS vulnerabilities than other sites, including the National Vulnerability Database (NVD) prior to its termination of service on April 5, 2016.  The days of "security by obscurity" are gone, and it is now time to realize the importance of implementing security programs specifically tailored for industrial systems and the operational technologies they utilize.

Several dashboards are now available that provide visitors with a real-time look into the global security landscape looking at current threat intelligence, the vectors used to launch attacks, as well as the origin of leading threat agents (sources). A unique dashboard is currently in development for  SCADAhacker that will provide a single landing page of important statistics and facts associated with vulnerabilities and associated exploits - targeting as best as possible those impacting ICS.

In addition to an extensive library of online information, SCADAhacker also offers public and private awareness and advanced training programs to learn, improve and apply the skills needed in industry today - those skills necessary to specify, design, assess, correct, monitor and maintain vitial industrial automation and control systems.

SCADAhacker is organized into several categories as described below.