Oh I assure you that you do not.

(Not knocking work learned on-the-job but rather than lack of standards across the industry).

So we don't yet know the details of the attacks but it is certainly possible that the systems that were attacked didn't patch a vulnerability identified earlier in the year.

I shared an analysis I found in another post.

In the past decade I moved from a place that took security very seriously to a place that I'm not sure even has a complete network diagram, so my expectations of competence in control system security in private companies is basically nil. It's slightly higher in some government systems only because it's a lot easier to be a tyrannical admin if people aren't really paying attention to you. But you gotta luck out and have the right person in the role.

what gets me is so no one took the france attack to heart and hardened their systems. I still don't seriously see why this is necessary. you have employees. doing a temp check at start and end and intervals between. heck have the cleaning staff do checks overnight. I mean the chance of having a freezer or fridge go down under thos circumstances long enough to lose product is small and if it does happen you lose like one units thing and thats it.

Third party access to HVAC is how Home Depot got hacked.

The disruption and the food loss are bad, but I really think the bigger problem is the potential for a persistent foothold.

If anyone is currently looking for a career, BAS technicians make bank. I don't even think you need a formal education either.

It's likely confirmation bias but I've never encountered a Building Automation System that didn't make me scratch my head and wonder where the adults were.

Just rename Florida to Trumpville

Good. You're doing something to help! I like that! Keep up the work. 😁

Help America? Nothing. I'm not american.

Help utilities in my own country? I'm doing my job, lol.

What are you doing to help?

U.S. officials have testified about People’s Republic of China (PRC) hackers’ capability and intent to be able to disrupt domestic infrastructure by 2027. This targeting of critical infrastructure by PRC army units creates leverage in a potential conflict, as the disruption of civilian life could impair policymakers’ capacity for rapid response in a crisis. While we cannot control the PRC’s strategic aims, we can reinforce the resilience of our communities.

UnDisruptable27’s mission is to bridge this preparedness gap by equipping communities on the front lines with the information, tools, and support they need to mitigate the impacts of increasingly complex and cascading infrastructure disruptions. By empowering local leadership, infrastructure operators, and everyday Americans with accessible, actionable insights, UnDisruptable27 aims to enhance national resilience… starting at the local level.

Wow. I'm actually speechless. I don't even know where to start. I feel like I'm going fucking crazy some times.

I thought it was widely accepted that the US was involved in Stuxnet?

Why focus on China and future capability and not the serious threats that have existed for almost 30 years? Like the incident in 2000 with a disgruntled former employee from an Australian water utility who used remote access to fuck things up. Or that time in 2013 that Iran logged in to the SCADA system of a Dam in New York? Or in 2023 when Iran left anti-Isreal messages on the HMI of a water utility in Pennsylvania? All the reminders of Russia capabilities and history of attacks that were published in 2022?

Where in their plan are they going to bully local politicians into properly funding water infrastructure? Oh, they think we need "clear, actionable step"s? Like the Roadmap to Secure Control Systems in the Water Sector published by the AWWA in 2009? Or their Water Sector CybersecurityRisk Management Guidance (2014)? Or other tools used to support the 2018 requirement for utilities that serve >3300 people to complete risk and resilience assessments and emergency response plans and certify their completeness with the US EPA? And how this same law mandates that US EPA provide guidance to smaller systems too? Like how the US EPA offers free cyber security evaluations, including risk mitigation templates and guidance on overcoming discovered vulnerabilities?

Armed with success stories and blueprints, U27 will get ahead of supply chain and other dependencies that would prevent this approach from scaling to the 6,000 hospital communities nationwide and beyond.

There is no way anyone involved in this has opened up a PLC cabinet in a water utility.

In my experience it is super location dependent. I've worked with municipalities who had shit locked down and others that made me think I was getting punked. All in Ontario.

I joined the industry in the early 2010s and it was a hot topic then too. This was when Stuxnet was in the news. ISA published Industrial Automation and Control Systems Security standards (ISA99) in 2002. It's not new.

I wonder how connected the folks who make decisions about utility cyber security are to each other. I learned almost everything I know about SCADA security practices via people I met through provincial wastewater industry associations and just letting them infodump lol. I don't know that any of the municipal SCADA people I worked with were members or participated. Maybe they are just trying to go at it alone vs collaborating and learning from each other. You don't know what you don't know!

I'd also be interested to know how old the PLCs at that plant were. We have zero details about this attack but when the Rockwell/AB exploit was in the news people were talking about buying cards off eBay because they are using discontinued PLCs. Can you imagine?

So, even if the staff understands the risk it doesn't mean they are getting enough money to do anything about it. Utilities are so underfunded. It's another ticking time bomb along with all those neglected pipes in the ground.

Check out www.Undisruptable27.org

It's going to take some sort of calamity to get utilities to secure their networks. I'm really surprised that it hasn't happened yet, tbh. There have been so many intrusions and a few really close calls already.

As someone who works in this area, I have some points:

1. More often than not, things like this are dictated by need and budget more than vanity. Sure, if it looks like a cluster might be close, a customer might press a vendor for a few more compute nodes to push them over the edge, but even that’s fairly rare. For the customer, being in the list at all is decent marketing fodder. For the vendor, having the top spot is cool, but having more systems on the list than your competitors could be argued as at least equally as cool.
2. This list covers systems that are publicly known about. It’s long been known that institutions like the US NSA have some impressive computing power whose specs are classified. They aren’t alone. Plenty of similar installations around the world, and not just in government. Financial companies, for example, can be quite secretive about their resources.

It attributes competition to cutting U.S. broadband prices in the United States since 2014.

However broadband prices have remained flat since 2014, and only fiberoptic has come down in price. The data also subsidizes DSL as broadband.

Fiberoptic deployment is famously anemic in the United States. It has categorically been developed like a caetel, avoiding compeition.

So imagine $80 for DSL being spun as a result of competition.

Seems par foe the course for Visual Capitalist.

Going by that definition the UK has way more than 113km of high speed rail as all intercity lines are built for 125mph operation.

The US actually has quite a bit more high speed rail, if you go by the definition of "rail that can be used at 200kph". There are >1000km lines between DC and Boston and New York and Charlotte. There's a LOT of high speed rail in the US.

Now, if you go by the definition of "lines where they actually go 200kph", there's about 65km of it, and only for a small number of trains at certain hours. That 65km is on 735km line, which is where this number comes from.

Most of the high speed capable rail is in places where the stops are too close to get up to speed properly, so it never hits high speed. Very dense areas are actually not that suitable for high speed rail, because you spend most of the time accelerating and decelerating and standing still to board. You want high speed rail in between more distant cities, not as a commuter train.

China gets that, but the US doesn't. And if you look at the rail in Europe, the trains stop every 10 minutes because they've reached another city.

How does this account for data caps vs unlimited plans?

Rail coverage by landmass and city is a more useful statistics

Considering how much the US has they are using a very generous definition of “high speed”

I think it's about a week if you go non stop. Most people take 3months but recommended is a year.

Having lived in one of the top 3 for a bit, bike friendly means that it's friendly for bikers to ride their bikes, not that the bikers are friendly. I kid, I kid.

Yeah, both Brooklyn and Queens are very much part of New York City. They are different counties, so that may be what their actual metric was?

Now i am wonder what the best lap time is for highway 1, AUS 🤔