Lost in the limitations of ‘cyber’: $15B in control-system losses

The blog was originally published in Weiss’ Unfettered Blog

The prevailing feeling about why there has been so little focus on securing control systems is that it isn’t real. What I constantly hear is “once there is a real control-system cyber incident I will spend the time and money to address the problem.”

Unfortunately, there have been already been many very significant control system cyber incidents. However, for various reasons, almost none have been identified as cyber.

I did some detailed analytics on my list of control-system cyber incidents based on the NIST definition of a cyber incident—“electronic communication between systems that affect C, I, or A.”  I have been able to identify more than 600 ACTUAL control system cyber incidents (I keep finding more) though most of the incidents were never identified with the word “cyber.”

The incidents are both malicious (more than one-third were malicious) and unintentional. The incidents have occurred globally in electric grid, power plants, nuclear, water/wastewater, pipelines, oil/gas, chemicals, food, manufacturing, and transportation.

My primary focus was on those incidents that have impacted reliability or safety (almost two-thirds of the incidents) though I have found many cases where viruses and worms were found on control system networks.

Most of the viruses and worms consumed internal resources but did not affect system reliability or safety. More than 25 incidents caused injury and/or deaths. More than 50 incidents resulted in equipment and/or environmental damage. A very conservative estimate of the direct costs of control system cyber incidents to date is more than $15 billion.

These are actual costs from real control system cyber incidents.

Control system cybersecurity is more than security researchers finding another “zero day” vulnerability. What does it take for senior management and decision makers to take control-system cybersecurity as seriously as IT data breaches?