Hack at German steel works.

Alienfish360 · 23 Dec 2014 at 10:10

There was attack on a nuclear enrichment plant in Iran.

I'm sure a steel works is likely easy fish in the scheme of things.

Slam62 · 23 Dec 2014 at 10:21

There must be some very well funded hackers about. Plenty of candidates for those who would like to disrupt things.
The dangerous ones are the ones which haven't been noticed of which I am sure there are quite a few .

edscdk · 23 Dec 2014 at 15:57

i think security is just a fail, unless you have huge money to throw at it... proper big dont care money... and have nazzi style inforcment staff...

long passwords, changed all the time? look under the keyboard... in the desk draw... just ring someone, say you are from support ask them for the password, or ring the help desk and say you forgot your password.

systems super locked down? too hard to make anything work someone will dual home a server or open a firewall...

I feel the best solution is just DO NOT PLUG INTO INTERNET...

TheVoice · 23 Dec 2014 at 16:01

Caged said:
Why wouldn't you have the control systems airgapped from the "I'm going to look at my company email" systems?

Presumably for remote monitoring, control etc.

touch · 23 Dec 2014 at 16:36

edscdk said:
I feel the best solution is just DO NOT PLUG INTO INTERNET...

IIRC the centrifuge controllers attacked by stuxnet were entirely disconnected from internet.

Rroff · 23 Dec 2014 at 16:39

touch said:
IIRC the centrifuge controllers attacked by stuxnet were entirely disconnected from internet.

We had a funny one at work once - IT guy who was always going on about security practises, etc. and not having stuff exposed to the internet - one day connects his personal laptop to the closed production system to install a printer driver and infected the network that way :S

D.P. · 23 Dec 2014 at 16:41

touch said:
IIRC the centrifuge controllers attacked by stuxnet were entirely disconnected from internet.

Some worker plugged in a USB thumb drive AFAIK.

sniffy · 23 Dec 2014 at 17:22

PlacidCasual said:
But we could imagine that some plants in our industry could be damaged but it would probably require inside knowledge of the industry to choose the appropriate parameters the right amount to cause damage without it being noticed or tripping.

I believe this is largely how stuxnet managed to be so effective. Avoided obvious failures but instead focused on a general degrading of equipment caused by subtle tweaks to firmware parameters.