Compliance fantasy for SCADA

 

• The Compliance Fantasy (IT Perspective): This panel shows a business person telling an IT professional, "Simple. Patch it and you're safe." This reflects the standard IT security mantra of "patching immediately" to address vulnerabilities. For IT systems, this approach is often feasible and is a core part of a strong security posture.

• The OT Reality (OT/ICS Perspective): This panel shows a concerned OT engineer or technician standing in front of an outdated SCADA system. They are faced with a dilemma: "Patch it? Risk public safety. Don't patch it? Stay vulnerable."

Technical Breakdown of the OT Reality

The accompanying text explains the technical reasons behind this "impossible choice":

• Legacy Systems: Many OT systems, particularly in critical infrastructure like water facilities, are decades old. The example mentions a SCADA system certified in 1998. These systems were not designed with modern security threats in mind and often lack the architecture to support secure patching.

• No Vendor Support: The text states, "The vendor no longer exists." This is a common issue with legacy OT. Without vendor support, there are no official patches available, and applying unofficial ones can be risky.

• Criticality and Stability over Security: OT systems control physical processes, such as a water facility's chlorine levels. Any unexpected behavior from a patch could cause a system malfunction, leading to a dangerous or even catastrophic event (e.g., "One wrong update could poison a city").

• System Integrity: OT systems are built for reliability and stability. They operate with strict timing and performance requirements. Introducing a software change, especially one not tested by the vendor, could destabilize the system, disrupting the process it controls.

• The Impossible Choice: CISOs (Chief Information Security Officers) are often faced with a no-win scenario. Security frameworks and advisories from agencies like CISA recommend immediate patching, but doing so could risk public safety. Not patching leaves the system vulnerable to cyberattacks, which could also lead to physical harm.

In essence, the image and text explain that applying a standard IT security control like patching is often incompatible with the operational requirements of OT systems, creating a fundamental tension between cybersecurity and physical safety in critical infrastructure.