SCADA

Coal Slurry Pipelines. The only operating U.S. coal slurry pipeline is the 439-km Black Mesa Pipeline that has provided the 1500-MW Mohave power plant of Southern California Edison with coal from the Kayenta Mine in northern Arizona since 1970. It is a 457-mm dia system that aimuaHy deHvers - 4.5 x 10 t of coal, the plant s only fuel source, as a 48.5—50% slurry. Remote control of slurry and pipeline operations is achieved with a SCADA computer system. In 1992 coal deHvery cost from mine to power plant was calculated to be 0.010/tkm ( 0.015/t-mi) (28). 

Personal Computer Controller Because of its high performance at low cost and its unexcelled ease of use, apphcation of the personal computer (PC) as a platform for process controllers is growing. When configured to perform scan, control, alarm, and data acquisition (SCADA) functions and combined with a spreadsheet or database management apphcation, the PC controller can be a low-cost, basic alternative to the DCS or PLC. 

Determination of critical assets that might be subject to malevolent acts that could result in undesired consequences What are the malevolent acts that could reasonably cause undesired consequences on these assets electronic, computer, or other automated systems that are utilized by the public water system (e.g., Supervisory Control and Data Acquisition (SCADA)) the use, storage, or handling of various chemicals the operation and maintenance of such systems... 

To sabotage the system, the former employee set the software on his laptop to identify itself as a pumping station, and then suppressed all alarms. The former employee was the "central control station" during his intrusions, with unlimited command of 300 SCADA nodes governing sewage and drinking water alike. 

Simply, SCADA is a computer-based control system that remotely controls processes previously controlled manually. The philosophy behind SCADA control systems can be summed up by the phrase, If you can measure it, you can control it. SCADA allows an operator using a central computer to supervise (control and monitor) multiple networked computers at remote locations. Each remote computer can control mechanical processes (mixers, pumps, valves, etc.) and collect data from sensors at... 

Since the SCADA systems sensors provided valuable information, many utilities and other industries established connections between their SCADA systems and their business system. This allowed utility/industrial management and other staff access to valuable statistics, such as chemical usage. When utilities/industries later connected their systems to the Internet, they were able to provide stakeholders/stockholders with usage statistics on the utility/industrial web pages. Figure 7.1 provides a basic illustration of a representative SCADA network. Note that firewall protection (see chapter 9) would normally be placed between the Internet and the business system and between the business system and the MTU. 

As stated above, SCADA systems can be designed to measure a variety of equipment operating conditions and parameters, or volumes and flow rates, or chemical and chemical mixture quality parameters, and to respond to changes in those parameters... 

Because these systems can monitor multiple processes, equipment, and infrastructure and then provide quick notification of, or response to, problems or upsets, SCADA systems typically provide the first line of detection for atypical or abnormal conditions. For example, a SCADA system that is connected to sensors that measure specific water quality parameters shows measurements outside of a specific range. A real-time customized operator interface screen could display and control critical systems monitoring parameters. 

According to the U.S. Environmental Protection Agency (2005), SCADA networks were developed with little attention paid to security, making the security of these systems often weak. Studies have found that while technological advancements introduced vulnerabilities, many industrial facilities and utilities have spent little time securing their SCADA networks. As a result, many SCADA networks may be susceptible to attacks and misuse. 

Physical. Intruders can break into a facility to steal or damage SCADA equipment. 

A study included a survey that found that many water utilities were doing little to secure their SCADA network vulnerabilities (Ezell 1998). For example, many respondents reported that they had remote access, which can allow an unauthorized person to access the system without being physically present. More than 60 percent of the respondents believed that their systems were not safe from unauthorized access and use. Twenty percent of the respondents even reported known attempts, successful unauthorized access, or use of their system. Yet twenty-two of forty-three respondents reported that they do not spend any time ensuring their network is safe, and eighteen of the forty-three respondents reported that they spend less than 10 percent ensuring network safety. 

Architecture. Many common practices negatively affect SCADA security. For example, while it is convenient to use SCADA capabilities for other purposes such as fire and security systems, these practices create single points of failure. Also, the connection of SCADA networks to other automation systems and business networks introduces multiple entry points for potential adversaries. 

The following incident helps to illustrate some of the risks associated with SCADA... 

According to the Government Accountability Office (2003), historically, security concerns about control systems (SCADA included) were related primarily to protecting... 

Control systems, such as SCADA, can be vulnerable to cyber attacks. Entities or individuals with malicious intent might take one or more of the following actions to successfully attack control systems ... 

The President s Critical Infrastructure Protection Board and the Department of Energy (DOE) have developed the steps outlined below to help organizations improve the security of their SCADA networks. DOE (2001) points out that these steps are not meant to be prescriptive or all-inclusive. However, they do address essential actions to be taken to improve the protection of SCADA networks. The steps are divided into two categories specific actions to improve implementation, and actions to establish essential underlying management processes and policies. 

The following steps focus on specific actions to be taken to increase the security of SCADA networks ... 

---