exida explains Blog

The Non-Hackable System – Wait a Minute, What?

The Non-Hackable System – Wait a Minute, What?

I had the privilege to attend the CDS-forum in Trondheim, Norway on October 15, 2019. The CDS-forum is a Norwegian Industry Forum for Cybersecurity of Industrial Automation and Control Systems. The forum is a co-operation between oil companies, engineering oil companies, consultants, vendors and researchers, with a…

Read More...

Are Your Control Systems Really Protected?

Are Your Control Systems Really Protected?

I don’t know whether you’ve noticed recently, but the number of cybersecurity alerts issued by CISA (Cybersecurity and Infrastructure Security Agency) seems to be increasing at an alarming rate.  The latest alert I’ve seen now relates to GPS tracking systems for children.  A device which is supposed to keep…

Read More...

Building Cybersecurity into Software Applications

Building Cybersecurity into Software Applications

An April 2019 report from the Institute of Critical Infrastructure Technology (ICIT) makes the point that even though software ‘runs the world’, software security is an afterthought across virtually all industries. 

The report states that this lack of software security is actually a National Threat given that this…

Read More...

IEC62443 - Learning Cybersecurity (Prevention Techniques)

IEC62443 - Learning Cybersecurity (Prevention Techniques)

Last Saturday, I read an article about hackers who were behind at least two potentially fatal intrusions on oil and gas industrial facilities (Yes I read cyber articles on the weekend wink). Besides the fact that I enjoy learning about cybersecurity on my…

Read More...

SCRUM and IEC 62443

SCRUM and IEC 62443

Information Technology (IT) is the personnel, hardware, and software that controls non-physical devices and/or processes such as websites, financial data, personal information, etc. 

Operation Technology (OT) is the personnel, hardware, and software that controls physical devices and/or processes such as manufacturing, oil & gas, power, etc.  Today, OT has many…

Read More...

Why the Docker Breach is Noteworthy

Why the Docker Breach is Noteworthy

All data breaches expose some type of IT (Information Technology) or OT (Operating Technology) system vulnerability. Cybersecurity professionals then need to evaluate and determine appropriate responses for themselves and their clients. It might be patching software, revising work processes or altering incident response techniques.

Docker

Read More...

CACE Specialties, Now That’s New!

CACE Specialties, Now That’s New!

Cyberattacks have become the new norm for industrial control systems. A recent study found that 54% (more than half) of companies surveyed had experienced a cyber-attack on their Industrial control system within the last two years[1]. 

The need for well-trained, competent individuals to address cybersecurity for industrial control systems…

Read More...

What can OT learn from IT data breaches?

What can OT learn from IT data breaches?

Does your organization even have a CISO position?

Cybersecurity continues to be an overlooked aspect in organizations—including those owning ICS (Industrial Control System) production facilities. Anyone following the news has most assuredly heard of the plethora of massive data breaches that organizations have endured over the last…

Read More...

Cyberattacks Succeed Where Humans and Systems Are Weak

Cyberattacks Succeed Where Humans and Systems Are Weak

Have you noticed that over the last several years, cybersecurity seems to be “trending?” 

Companies of all sizes are starting to learn how to prevent, or at least minimize, these attacks. They hire third-party experts and attend trainings to learn more about the human and system weaknesses that are…

Read More...

Does Your ICS Service Provider Need Training?

Does Your ICS Service Provider Need Training?

Today’s owner operators and lease operators of industrial production facilities frequently employ service providers for projects and upgrades, as well as operations and maintenance. These contractors often travel to many sites, carry their own copies of source code and files, and use multiple PCs with multiple engineering tools for…

Read More...

Bridging the OT / IT Cybersecurity Gap

Bridging the OT / IT Cybersecurity Gap

Personnel responsible for protecting organizational assets within Operations Technology (OT) groups would seem to have the same mission as those responsible for protecting organizational assets within Information Technology (IT) groups, and be tightly aligned. Spending any amount of time with Industrial Control System (ICS) clients, however, shows that is…

Read More...

Cyber Risk Assessments and Security Level Verification: Security Level Verification (Part 3 of 3)

Cyber Risk Assessments and Security Level Verification: Security Level Verification (Part 3 of 3)

The exposure of industrial facilities to cybersecurity threats has never been higher. An analysis performed by IBM security found that the number of attacks on SCADA systems increased 636% from 2012 to 2014, with 675,816 cybersecurity incidents in January 2014 [1]. Finding an effective method for evaluating the current…

Read More...

Cyber Risk Assessments and Security Level Verification: Detailed Risk Assessments (Part 2 of 3)

Cyber Risk Assessments and Security Level Verification: Detailed Risk Assessments (Part 2 of 3)

The exposure of industrial facilities to cybersecurity threats has never been higher. An analysis performed by IBM security found that the number of attacks on SCADA systems increased 636% from 2012 to 2014, with 675,816 cybersecurity incidents in January 20141. Finding an effective method for evaluating the current level…

Read More...

Preventing Cyberattacks by Following Practical Guidance in IEC 62443

Preventing Cyberattacks by Following Practical Guidance in IEC 62443

Isn’t it frustrating when you experience an event that disrupts operations and then discover it could have been prevented? Very often a detailed analysis will reveal that a combination of (preventable) mistakes and unknown factors caused the incident. Training can help the mistakes, but dealing with the unknowns is a little…

Read More...

IACS Cybersecurity IEC 62443: Agile Lifecycle and Documentation

IACS Cybersecurity IEC 62443: Agile Lifecycle and Documentation

Industrial Automation Control Systems (IACS) Cybersecurity based on IEC 62443 was created to be compatible with agile development methodology. The standard deliberately talks about processes and not phases, such as those in the waterfall model. The processes defined can be met simultaneously and are, most likely, already being followed…

Read More...