Comment I too work with SCADA systems (Score 2, Insightful) 227

by jake-itguy on Saturday November 06, 2010 @08:36PM (#34150660) Attached to: Evaluating Or Testing Utility SCADA Security?

The town I work for has a SCADA system for it water treatment plants and lift stations. A lift station pumps sewage to the wastewater treatment plant. SCADA (at least in my town) has two main components. The first component is a control station which is a Windows XP SP2 PC. A read-only monitoring terminal is also a Windows XP SP2 PC. The second components are several small boxes inside cabinets to which various sensors and radio links are attached. Each lift station, water treatment plant, pump house, etc. has a SCADA cabinet with the small box in it. The sensors are usually RS-232 or RS-483 and connect via RJ45 adapters to the designated ports. A Radio link is in each cabinet. Each SCADA box has an ethernet jack to connect it to a network. The lift stations and pump houses don't have a network connection back to the town's network so those stations are fairly secure.

When I started at this job the SCADA system was on the same network as the town's PCs. I fixed this by moving SCADA to its own network with no internet access. It took several days and alot of cabling (the remote terminal was the hard part) but I did it. Two weeks later there was a problem and the head water person could no longer remotely access the system to fix it. I compromised and allowed VPN access to the SCADA system. A totally non-Internet accessible SCADA system is impossible. Even if you have someone monitoring the system 24/7 on site so no VPN access is needed, your Frame Relay, T1, or other connectivity options are certainly internet accessible.

Next we have 9600 baud radio links from each remote station back to the main SCADA control station. I have no way of knowing if the information over these links is encrypted or not. Siemens says the information is encrypted but I can't verify it.

Siemens also loves XP SP2 and refuses to support us if I install XP SP3, patches, or anti-virus on the system. I can't even turn on the windows XP SP2 firewall. Siemens also seems to love Symantec PCAnywhere. Every PC that has Siemens software has Symantec PCAnywhere installed it. Versions range from 10 to 12. We just had a third SCADA PC installed and it is still XP SP2 and PCAnywhere 12, not even 12.5.

The best I could do was to physically isolate the SCADA systems to their own network. Allow VPN access only to the control station. I installed RealVNC server on the control station and put a password on it. I setup a laptop with VPN client software and the RealVNC client. So the user connects to the VPN enters a username and password (password changes every 6 months and it is at least 10 characters long, mixcase alphanumeric password), launches the VNC client and enters the VNC password (not the same password as above but uses similar specs).

I look forward to reading the rest of the posts.

Submission + - issue with comcast a2d conversion for municipality

Submitted by jake-itguy on Wednesday July 07, 2010 @12:26PM

jake-itguy writes: I am the IT guy for a small town municipality. Comcast called me the other day and told me I had to have a digital to analog converter for each TV in the municipality as comcast is turning off analog cable in September. I did a quick count and we have 32 TVs across 6 buildings (22 being in the police and fire departments). Most of the TVs are hung on the walls. I told comcast having a box for each TV was not acceptable and wanted a different solution. Comcast told me there was no other solution. They told me they have been putting these boxes on every TV in each classroom in each school. I laughed when I heard that. I said do you know how much electricity is going to be needed for each box. They didn't know the answer. I was bumped up to the next guy in the comcast hierarchy who said there was no other solution and I had to pay $3 per month for each box. Being a municipality we are entitled to free expanded basic cable as a part of the franchise agreement back in 1982.

I know there is a solution as hospitals and hotels don't have little boxes next their TVs. Unfortunately I haven't found a specific answer to this problem so I am asking Slashdot. Is there a box that can be put in the basement of the town hall that will convert the comcast signal into a regular digital signal? Most of the TVs in the town have digital tuners per last years a2d conversion of the airwaves. I would be willing to replace the few analog sets with new ones if there is a good solution for this. Each building's cable feed is fed from the town hall. We have a nice big 1 inch cable coming into the building with some splitters coming off the line. Each building gets a 1/2 inch cable. Is there a box that will convert the comcast signal to analog for the schools? I am sure the schools don't have TVs with digital tuners. I am in Indiana if that is useful.

Thanks,
Jake

Slashdot Top Deals