Threatpost Special Coverage: Critical Infrastructure Under Attack

In a series of articles in the last 12 months, Threatpost has documented the struggle of independent researchers, technology vendors and the U.S. government as they come to grips with a fast-changing landscape of cyber threats to and attacks on industrial control systems (ICS) and Supervisory Control and Data Acquisition (SCADA) software.

Threatpost’s August, 2011 story “Black Hat: Remote DOS, Backdoor, Easter Egg Among Newly Discovered Siemens Holes,” for example, was one of a handful nationally to report on the results of a backroom summit between security researcher Dillon Beresford and representatives of the DHS’s ICS-CERT, technology maker Siemens and The National 

Institute of Science and Technology (NIST) to discuss the discovery of critical software vulnerabilities affecting industrial controllers from Siemens.

In December, 2011, Threatpost coverage of warnings from security researcher Billy Rios about an attempt by Siemens to cover up security holes in its Simatic software prompted the company to publically pledge to fix the holes.

In 2012, stories like “Looking for a ‘FireSheep Moment,” Researchers Lay Bare Woeful SCADA Security” captured the work of Project Basecamp, a small, volunteer effort among the world’s top security researchers to expose common and easily exploitable security holes in critical infrastructure. Threatpost brought readers up close to top ICS experts using podcasts and candid interviews with experts like German researcher and Stuxnet expert Ralph Langner about his research into the worm that targeted Iran’s uranium enrichment facilities, and the way that market forces can complicate the goal of securing industrial systems.

Not content to merely present the views of security researchers, Threatpost wrote about the challenges of federal officials to respond to the growing threat of cyber attacks on critical infrastructure with articles like “DHS Thinks Some SCADA Problems Are Too Big To Call ‘Bug’” from September 26, which called attention to the Department of Homeland Security’s changing views on how to classify and address security vulnerabilities in critical infrastructure.