The “Short Arm” of Predictive Knowledge
From this week’s Jonas Reading: How should we approach the development of cyber-policy and infrastructure given the “short arm” of predictive knowledge?

According to the Jonas reading this week, there are many ways to approach the development of cyber-policy and infrastructure. Short arm predictions can be utilized to predict future human behavior based on previous data related to previous behavior and actions. While it is not possible to predict with 100% accuracy, it is possible to make an educated guess on the future based on certain variables and factors. In order to make accurate predictions, it is crucial to be informed on new kinds of threats and technologies, and ways to avoid and mitigate said threats and risks.

Protecting Availability
In this discussion board, you are the CISO for a publicly traded company. What protections would you implement to ensure availability of your systems (and why)?

• Scalability
• Adapt to compliance regulations
• Reduce human error, ensure competent HR. (human error is a huge cause)
• Ability to recover from disaster (part of resilience)
• Establish a crisis communication channel (communication)
• Incident tracking

Write-Up – SCADA Systems

What is SCADA?
Supervisory control and data acquisition (SCADA) refers to ICS (industrial control
systems) used to control infrastructure. The usual subsystems of a SCADA system includes an apparatus controlled by a human operator, a supervisory system to gather data about the process, remote terminal units that connect to sensors and convert signals to digital data, programmable logic controllers, and communication infrastructures which connect the remote terminal units to said supervisory system. A SCADA system does not commonly control the processes in real-time, and instead coordinates said processes in real-time.
A SCADA system is a centralized system that controls and monitors an entire site.
Almost all control actions are automated by the RTUs (remote terminal units) or by the PLCs (programmable logic controllers). The host control functions usually include supervisory level intervention or basic overriding.
The Human Machine Interface allows the processed data to be viewed by a human
operator, and is used by that operator to control processes. The HMI provides diagnostic data, logistic information, schematics, and more in order to assist the operator. The HMI interface is graphical, usually displayed in mimic diagrams.
Security Flaws and Vulnerabilities
While SCADA-based systems are useful and commonplace, there are possible
vulnerabilities at play. SCADA networks are believed to be safe enough due to their physical security, and lack of connection to the internet. However this is not entirely true. SCADA systems are used for important physical processes, such as traffic lights and oil pipelines.
Security is incredibly crucial, and cyber attacks have devastating consequences.
The first major threat to SCADA systems is unauthorized access to the software through
human access, viruses, etcetera, which affect the control host machine. The second major
threat has to do with commonly unsecured packet control protocols. This means any bad actor could send packets to a SCADA device, and control it (Trend Micro, 2019). Physical access to network switches and jacks provides attackers with the ability to bypass security and control SCADA networks.
Solutions and Conclusion
These risks are being addressed by developing and utilizing VPNs and firewalls for SCADA networks. In addition, whitelisting has been implemented in order to prevent bad actors from making changes to SCADA applications. These changes, while still in development, will eventually result in a more secure SCADA system for the next era of technology, bringing safety and security to the people who depend on them.

References
Trend Micro. (2019, December 16). One Flaw too Many: Vulnerabilities in SCADA Systems. Trend Micro. Retrieved March 23, 2023, from https://www.trendmicro.com/vinfo/us/security/news/vulnerabilities-and-exploits/one-flaw-too-many-vulnerabilities-in-scada-systems