A few odds and ends from my one day at ISA Expo

• The Expo offers an interesting dichotomy on security that may demonstrate a broader point. ISA SP99 is arguably the most active and productive control systems security body (one could make a case for NERC and some IEC committees as well). Yet walking the ISA Expo floor shows little or no vendor interest in security. In fact, I believe the mentions of security on booth walls was significantly down from two years ago. What does this say for the business case for SCADA security?

• Based on the early brainstorming meeting it appears that SP99, Part 4 is going to be a challenge. I’m unsure what to even write on Part 4 after attending most of this meeting. Just to be clear, this is not meant as a negative comment. It is very early. The point is writing and gaining consensus on specific requirements is likely to be much more difficult than the work on defining technologies and models and providing broad guidance.

• Enterasys exhibited a new hardened switch designed to survive in a field site environment. The product had a number of security features, but nothing that is different than what you would find in a Cisco or other leading managed switch. The news here is Enterasys was at the show and targeting this market to some degree.

• Elpro actually had an answer as to why their wireless product is better for SCADA than a market leading IT wireless solution. Environmentally hardened, serial connections, and ability to do 802.11 over 900MHz. My unsolicited advice to any vendor coming out with a SCADA security product is to have a strong answer to this question. There needs to be some serious benefits to take a chance on a new product over a market leader.

• SEL was there with the field encryption product that has been out for a couple of years.

• The ODVA - EtherNet/IP booth said there were no plans to add security to the protocol, but a security whitepaper was in development.

This plus Eric’s Tofino is what I saw in the time I had to walk over half of the floor.