Re:At Dawn We Sleep
by pnathan on Friday December 07, 2012 @10:58AM
(#4887448)
It's absolutely true that SCADA systems are horrifically insecure and there is very little incentive for a private company to upgrade security. It costs a lot and doesn't give ROI (yet).
Something must be done, sooner would be better than later.
I would rough out a plan like so:
* CIP companies must upgrade their security, which will be audited by Federal pentesters.
* Their security upgrade will be funded partially through grants.
* Failure to implement security will incur fines sufficient to ruin the company, without exemption.
* Audit findings will incur fines scaled according to the severity of the audit finding.
Note that CIP companies are in a different class than other companies. These companies ensure that life goes on. Water treatment plants, electrical utilities, other similar installations. These companies by their nature ought to be subject to a more careful eye by the public, because the public depends on them.
Something must be done, sooner would be better than later.
I would rough out a plan like so:
* CIP companies must upgrade their security, which will be audited by Federal pentesters.
* Their security upgrade will be funded partially through grants.
* Failure to implement security will incur fines sufficient to ruin the company, without exemption.
* Audit findings will incur fines scaled according to the severity of the audit finding.
Note that CIP companies are in a different class than other companies. These companies ensure that life goes on. Water treatment plants, electrical utilities, other similar installations. These companies by their nature ought to be subject to a more careful eye by the public, because the public depends on them.