Forgot your password?
typodupeerror
Government Security The Internet Science

Feds Offer $20M For Critical Open Source Energy Network Cybersecurity Tools 56

Posted by samzenpus
from the won't-somebody-please-think-of-the-energy-supply? dept.
coondoggie writes "The US Department of Energy today said it would spend $20 million on the development of advanced cybersecurity tools to help protect the nation's vulnerable energy supply. The DOE technologies developed under this program should be interoperable, scalable, cost-effective advanced tools that do not impede critical energy delivery functions, that are innovative and can easily be commercialized or made available through open source for no cost."
This discussion has been archived. No new comments can be posted.

Feds Offer $20M For Critical Open Source Energy Network Cybersecurity Tools

Comments Filter:
  • wire cutters (Score:3, Insightful)

    by Anonymous Coward on Monday February 11, 2013 @05:21PM (#42865903)

    easy - a pair of wire cutters and firing of those responsible for hooking up naively coded devices to untrusted networks.

    • by Langalf (557561)

      Given the amount of trouble I have convincing supposedly intelligent people NOT to hook things up to our control network willy-nilly, I certainly agree with this sentiment.

      • by icebike (68054)

        Given the amount of trouble I have convincing supposedly intelligent people NOT to hook things up to our control network willy-nilly, I certainly agree with this sentiment.

        While that might be part of solution, remember that Stuxnet was delivered on a thumb drive.

        Also remember that you need some computer system for plant management in the modern world. If not for doing actual machine control, at least for doing monitoring and reporting. And therein lies the problem. Even if you air-gap your control network from your corporate net, you have to put stuff onto the control net and take stuff off. And you still end up hooking a lot of machine controllers to your control network.

        • by Type44Q (1233630)

          While that might be part of solution, remember that Stuxnet was delivered on a thumb drive.

          That's why the other half of the solution is "don't run your centrifuges with the same damp, soggy operating system that you use to connect to the Internet... :p

        • by dbIII (701233)
          You mean just like the way we were doing it in the early 1990s?
          The practices to solve the problem are clear but people just think it's inconvenient to implement them. Read only when it doesn't need to be anything else and get those MS video games machines out of the environment - if people want to connect to the real systems and use a MS video games machine to do it there are plenty of ways to present information to them without giving those buggy malware infected piles of shit full access.
    • by kilodelta (843627)
      Or - disconnect all SCADA devices from the network. Better yet, wire up an authentication module for the SCADA device instead of leaving security hole laden SCADA devices out there. Then of course you could re-write the IP stack for SCADA and vary the delay timing. That will stop a good many attacks.
    • by Shoten (260439)

      Check out the latest edition of the ICS-CERT journal. Replacing Ethernet with USB drives or other media...and you cannot do offsite backups without them, mind you, nor can you offload data for analytics, reporting, or support any other way...is not really an air gap. All it does is remove some degree of vulnerability while greatly hindering your ability to do things like patch management, security monitoring (are you going to put a separate Nitro Security or ArcSight instance into every power plant, with

    • by jmcvetta (153563)

      Actually this is probably the right solution. More and more I am convinced we must air gap all safety-critical systems from the internet. Big stuff like power stations and industrial equipment obviously; but also small stuff like building HVAC, generators, etc. This includes self-driving cars - the drive controller must be physically unable to communicate with any network.

      It's basically a minimax situation. We have to minimize the damage from the maximal failure mode. With networked control systems, th

    • by gweihir (88907)

      Indeed. But from the description of what they want, I deduce they are completely clueless about what is and is not possible and hence, they may have trouble actually using a wire cutter due to lac of skill.

  • by trdtaylor (2664195) on Monday February 11, 2013 @05:24PM (#42865935)

    "interoperable, scalable, cost-effective advanced tools that do not impede critical energy delivery functions, that are innovative and can easily be commercialized or made available through open source for no cost."

    Choose two.

    • by alostpacket (1972110) on Monday February 11, 2013 @05:48PM (#42866217) Homepage

      1) Interoperable
      2) Scalable
      2a) Cost-effective
      2b) Advanced
      2c) Does not impeded critical energy functions
      2d) Innovative
      2e) I.) Easily commercialized
      2e) II.) Or, made available through open source
      2d) No cost.

      Per your request ID (#42865935), we have met your requirements and expect work to implement the product to commence immediately.

      Cordially ruling in your best interest,
      - The Government

      (at least now we know what "step 2) ????" is)

  • Software solutions are all well and fine, but I find it highly ironic that the menace comes from the internet, an offspring of a DARPA grant that had reliability and redundancy at its core. Granted, the possibility of somebody lobbing H bombs has receded since the cold war, but a little physical investment would do a power of good, especially since it would cost a fraction of the subsidies sunk each year in renewable energy.
    • Re: (Score:3, Funny)

      by stewsters (1406737)
      The quantity drop down only goes to 30. We are going to need a few more if we are going to secure our infrastructure in a timely manner.
    • by Art Challenor (2621733) on Monday February 11, 2013 @05:54PM (#42866281)
      Comments of the type "just don't connect to the Internet" are a little short-sighted. Much of the energy, water, wastewater, etc. etc. infrastructure is remote. Think substations, liftstations, pumpstations, smart switches, etc. etc. For some of these a dedicated network may make sense, but there's a huge cost saving in using the existing networking buildout, ie the Internet, to monitor and indeed control these types of facilities. Many of these are small, a controller, something that does something (pump, switch, whatever) and a small amount of monitoring.

      Securing this IS a challenge, espeically since the vast majority of the equipment used in these facility was (and continues to be) designed with no inherent security, but having someone drive to a remote facility to check it, or install an end-to-end custom network is a much bigger project and is simply not possible - taxpayer would (rightly) object to the cost.

      There are many other situation where there is a solid "business case" for having an asset connected to the Internet, remote maintenance, tracking, etc. Not necessarily as critical, but would still benefit from a secure solution.
      • I work for an ISP. Dedicated solutions aren't all that hard or expensive. They're just usually slow. Most cash registers have less than a 56k connection, but they never touch the internet. The problem is the government loves to overspend, and overplan. So I'm sure their plan involves full HD realtime video of the facility or some other stupid shit they don't need on their secured network. Put command and control on your private network. Put your security cameras on... well anything else.

      • Even if you can't justify a full rocking-it-old-school-with-our-own-private-leased-lines-from-everywhere-to-everywhere, you'd still hope that(given the truly deplorable state of the various devices in important places), you could spring for a logically isolated network running on top of your cheap internet connection.

        VPNs and such add additional complexity, and aren't invulnerable by any means; but there is a middle ground between 'physically private network' and 'on the internet', which at least allows you

      • by penix1 (722987)

        To add insult to injury, the power companies in my state are 100% private companies. So here we go bailing out private companies using tax payer money to fix a problem cause by their short sightedness. This again is a failure of capitalism or should I say another success of private industry externalizing the risk and privatizing the profits. I say fuck 'em. Let them use their profits to fix this problem they created.

      • No, the obverse is true.

        Connecting these gadgets to the internet is the short sighted "solution", which has caused more problems than it solved.

        When building infrastructure, isn't it more intelligent to build the INFRASTRUCTURE? Run a wire out to the gadget, directly from the control station!! Not wireless, but a wire!

    • by c0lo (1497653)
      Underbid [aliexpress.com] to 5% of the competition price.

      Warning: may have backdoors planted by People's Liberation Army.

  • Wasn't the cyber threat to our critical infrastructure overblown by DHS and CyberCom just to get a bigger budget? Why is DOE so concerned that they're going to spend 20 million of their current budget?
    • by Synerg1y (2169962)

      It's now, or later? I don't think they considered cyber security when setting up the electrical plants and grids too much back then.

      • by vlm (69642)

        sure they did, they just didn't have the budget.

        The fiber my local powerco installed along the ROW for their SCADA didn't go in until decades after the blueboxers where having their way with Ma Bell.

  • There isn't one word in the referenced article that is specific to energy delivery systems.

    These guys are asking for the silver bullet to solve any cyber security problem in any system from any threat. The reward:, a measly 20 million.

    • by bill_mcgonigle (4333) * on Monday February 11, 2013 @06:18PM (#42866535) Homepage Journal

      These guys are asking for the silver bullet to solve any cyber security problem in any system from any threat. The reward:, a measly 20 million.

      It's a government contract - you don't actually have to deliver. /snark

      But, yeah, for $20M my company could coordinate one hell of a automated crypto system (hardware & software) to layer on top of SCADA gear that would protect it from unauthorized use and of course it would be open source. I can think of a dozen grants that need to happen immediately on various open source networking and crypto software packages to make them better suited for the task. It would not be perfect (it cannot be) but it would be tremendously better than the status quo and it would all be free for deployment on commodity hardware or from an ecosystem of willing cooperators.

      The trouble is, the requirements for government contracting self-select for companies that can't even do the paperwork for less than $20M.

  • Unplug it from the net!

    Do I get my 20 million?

  • As far as identifying and responding to intrusions, it seems everything is already there, just needs to be implemented with agents that can monitor controllers, which I'm sure has already been coded anyway. Mashups of current security tools like SecurityOnion http://securityonion.blogspot.com/ [blogspot.com] would be a good starting point methinks.
  • by vlm (69642) on Monday February 11, 2013 @05:57PM (#42866317)

    TLDR of the whole topic: Can't prevent layer 8 malfunctions via any method at any lower level 1-7. There is NOTHING the techs can do if mgmt fails. No checkbox can save them, no silver bullet can save them...

    • Are you sure that silver bullets don't work against management? They work on most meat-based targets, as well as werewolves...

      • management? They work on most meat-based targets

        Thar's y'er problem - everybody knows management is entirely made of hot air.

      • by gmhowell (26755)

        Are you sure that silver bullets don't work against management? They work on most meat-based targets, as well as werewolves...

        This is the government. Think less Lon Chaney and more Bela Legosi, and you'll see why silver bullets are ineffective. (Although given it is made of the stapled together remains of some other dead agencies and has an abby normal brain, I'm thinking DHS might be Frankenstein (Yes, yes, Frankenstein's monster pedants))

    • by Anonymous Coward

      The 8th layer of the ISO Model: Operator.

      The 8th layer of GSA: Some asshole operator who controls $20 in discretionary spending,
      or the ability to convince those assholes that do, and can string together 21 words,
      that he got from the internet, pasted on a Life Game spinner, and cooked up
      some verbiage that made the assholes with $20 in discretionary spending happy.

      Too bad that nobody writing this, or controlling the money or
      even thinking about this at the 8th layer of GSA, ( did you fill out the form 355-2/B?

  • by DarkOx (621550) on Monday February 11, 2013 @06:15PM (#42866493) Journal

    do not impede critical energy delivery functions

    Sorry but security is all about impediment. I am going to get jumped all over for saying this but its true.

    People attempt to do bad things when three forces meet: opportunity, pressure, and rationalization whether that last one is because "Dear Leader told me too" or "I deserve it" is immaterial.

    There is nothing you can do in software about the last two. So that leaves opportunity as the only high ground on which to mount a defense. Guess what that means impediment is just about your only tool. Good luck upgrading all those ancient controllers to use solid authentication, and integrity protocols. Good luck tasking the folks who have been ignoring these problems for the past 20 years (best case), or doing it wrong getting lucking and thinking themselves clever (more likely). Expired certificates etc if they are actually checked will be an impediment. Offline those old EDI systems while everyone figures out how to do sftp will be a problem when nobody knows how to keep control of their know host keys; and those are just some of the easy ones.

    The Feds need to pull their heads out of there ass and realize security is about doing the right thing everywhere all the time. Process Process Process. All the technology in world won't help you unless people do the right thing. The Superbowl gate crashes should have tough them that. Computer security is no different. Sure technology can help. Its wonderful today that we have the scalability to do inline IPSing and a firewall can stop things like SQL Slammer (when signatures exist). Won't do a lick of good if some admin decides to turn it off to trouble shoot and than goes "welp everythings working and i feel like headed hope now so, f**k it deal with tomorrow".

  • Dried dung! It's scalable and very easy to distribute. Just wash your hands after collecting it!!! Try to plug your thumb drive into that assholes!!!!
  • by lightknight (213164) on Monday February 11, 2013 @07:32PM (#42867055) Homepage

    Here's a solution -> hire a bunch of BOFHs to do your security for you. True, you have to keep them happy, but the upside is that security could never be tighter / more fatal for anyone trying to crack your network.

    In other words, go find some out of work network admins, the older the better, and employ them in this capacity. They know how to make things pretty air-tight (usually), but are rarely directed to do so (because people HATE it when security is ramped up to Defcon 0; it makes getting work done somewhat difficult, but in theory, very secure). They will, in theory, employ several different strategies to secure their networks, to the insane point of watching the bits crawl across the wire with human eyes to detect patterns that shouldn't be there. There is no magic wand for network security -> if you want to keep humans (and AIs) out, you need to employ comparable assets.

  • 1) SCADA networks don't get to company Intranets or the Internet.
    2) Disable any portable access devices, from USB ports (thumb drives etc.) to CD/DVD optical drives.
    3) All software is clean room tested and deployed by technicians. Only authorized Technicians are allowed to install or change any software configuration on the system.
    4) Vulnerability Testing is done in an isolated lab environment to weed out any potential problems with the system.
    5) When in doubt, repeat starting at step #1

    • Yea... few things wrong with this.

      1) Managers will want to see the data produced from a SCADA system. From the intranet. From home. From anywhere. Small utilities don't have 24/7 control centres, so they will have people operating the system from their homes after hours. You need to get real here. You will connect it to the internet, using secure methods. SCADA networks aren't often air gapped except for the radio links.

      3) Yep, usually, but sometimes see 4)

      4) You have to be a pretty decent
      • by Virtucon (127420)

        And that's why there are exposures to hacks and other vulnerabilities. There are ways of providing data without compromising the integrity of the network and while I agree that small players may have more economic challenges in securing their infrastructure they have to have a minimum level of competency to guarantee that some damn worm, malware or an inadvertent "aw shit" from a technician doesn't take them out of operation or do permanent damage. Yes, I agree with you that management personnel are the w

        • I agree with most of what you are saying, but I still don't see a need to completely isolate (physically) SCADA from other networks - it can be done in a pretty secure manner. For an example, in my country the National Grid System Operator provides access to its SCADA Network to distributors essentially by a giant VPN. If we didn't have this access we would be back to the days of ringing up the System Operator to do network switching by telephone.

          The problem of IT running SCADA systems is a big one, I
  • Two Words: Air Gap (Score:3, Insightful)

    by rsagris (831741) on Monday February 11, 2013 @08:07PM (#42867313)

    Seriously: water, power, and other critical utility infrastructure providers are not a low density/low volume market. There are large enough economies of scale such that there should really be no discussion here. There should be a separate physical network for these industries.

    Air gap the network, heck, develop and mandate totally new hardware interconnects to ensure some moronic PHM or more likely brain dead network admin isn't physically capable of connecting COTS hardware to SCADA hardware.

    There is absolutely no reason for any of this stuff to be directly accessible to the public internet, the utility provider can very well have some data diode http://en.wikipedia.org/wiki/Unidirectional_network/ [wikipedia.org] to provide metering information on the public internet side, but there absolutely should be no bidirectional links between the command and control network and the public internet

    There would be no astronomically expensive software validation necessary if these industries were mandated to require Hardware level compartmentalization, which funnily enough a custom hardware solution would be orders of magnitude cheaper and deployable now rather than some pie in the sky (never going to happen) software based solution that the "Tube" worshiping ludites in Washington think can actually be created

    -RS

  • How about 20 billion? They sure as shit dont mind spending that on guns. Tech can do MUCH more damage.

  • made available through open source for no cost."

    "The US Department of Energy today said it would spend $20 million

    So $20 million is free to them?

    That explains a lot...

  • by Anonymous Coward

    (Posting anonymously for reasons that will become apparent.)

    So they want to spend $20M for technology that's going to improve security? Well, here's an idea: hire more people at these critical energy companies. I work for one, and let me tell you, we're already passing up technology we could be using because none of us have the fricken time to learn it, propose a baseline configuration and integrate it into our existing processes.

    • SELinux, which has been out for over 9 years? Nope, just disable it.
    • Intrusio
  • [unplugs Ethernet cables]
    'That will be $20 million, please.'

Felson's Law: To steal ideas from one person is plagiarism; to steal from many is research.

Working...