I will be previewing one S4 2009 paper each week. Digital Bond’s SCADA Security Scientific Symposium is Jan 21-22 in Miami Beach with an advanced control system security course on Jan 20th. For more information on the event and registration check out these links:

• Agenda at a Glance
• See the full agenda with detailed paper descriptions
• Register to be a physical or virtual S4 attendee

An Analysis of Two New Directions in Control System Perimeter Security

Commercialism is always taboo at events like S4, but we do want to have information and analysis on the latest security technologies that often come from a vendor. In the previous two S4 events, we had a couple of vendors present the technology in a non-commercial manner, and this did not go over well. I think we have found the solution. We have a set of researchers perform an independent analysis of some new vendor technology.

In this paper Ludovic Piètre-Cambacédès and Pascal Sitbon of Electricité de France describe and analyze two new security perimeter technologies: true one-way communication devices and deep packet inspection of control system protocols. The one-way communication is currently being targeted by Waterfall at the control system market, and Byres Security and CheckPoint are doing deep packet inspection of Modbus/TCP in their perimeter security products.

The part I found most interesting is the discussion on where this technology may make sense – - and where it does not – - in a control system.

There is a very impressive, 27-page, well referenced paper provided by this talk. In fact, the quality and the detail in the papers this year is unprecedented at S4. It will be a fatter Proceedings book and not because of fluff.

Other S4 Previews

• Leveraging Ethernet Card Vulnerabilities in Field Devices
• S4 Keynote: Dr. Ross Anderson – The Economics of Control System Security
• Jamming and Interference Induced Denial of Service Attacks on IEEE 802.15.4 Based Wireless Networks
• Hardware Vulnerabilities in 802.15.4 Implementations
• Estimating 0days in Control Systems
• Security Metrics for Cyber Security Assurance