The 2024 RSA Cybersecurity Conference: What wasn’t addressed can hurt you

May 17, 2024
Was the real scope of control system cyber incidents properly addressed?

The RSA Cybersecurity Conference in San Francisco is billed as the largest cybersecurity conference in the world with something like 40,000 attendees. I have been attending the RSA Cybersecurity Conference since the early 2000’s and have spoken there a few times. RSA is a five-day conference with the IT cybersecurity rock stars presenting.

I only attended for two days. My observations are unscientific. Given that preamble, on the surface, things are getting better as most everyone I talked to had heard of OT, though most only knew the title, not what it really meant. Those that knew what OT stood for felt it was just about the OT networks. Very few people had heard of control system cybersecurity, and even some of the OT vendors were not aware of the lack of cybersecurity in the process sensors that are inputs to their network monitoring.

No one I talked to was aware of the real scope of the problem or was aware that have been millions of control system cyber incidents. This was evident in that the control system cybersecurity rock stars were not speaking. This year, critical infrastructure cybersecurity took a prominent position with the issuance of NSM 22. NSM22 states: “it is diverse and complex, and includes distributed networks, varied organizational structures, operating models, interdependent systems, and governance constructs.” There was no mention of hardware.

Yet the critical infrastructure is dependent on hardware – pumps, motors, valves, relays, transformers, turbines, robots, etc. As a result, there were no discussions of hardware control system cyber issues such as hardware backdoors in Chinese electric power transformers, port cranes, inverters and circuit breakers; possible control logic compromises with the Iranian Unitronics’ PLC attacks; Russian cyberattacks against U.S. critical infrastructures; the Aurora vulnerability which manipulates physics not data; data center shutdowns from process sensors and chiller motor issues; and medical device control system cyber incidents that have injured hundreds.

Maybe next year RSA will have more of a focus on critical infrastructure cybersecurity.

Sponsored Recommendations

2024 Industry Trends | Oil & Gas

We sit down with our Industry Marketing Manager, Mark Thomas to find out what is trending in Oil & Gas in 2024. Not only that, but we discuss how Endress+Hau...

Level Measurement in Water and Waste Water Lift Stations

Condensation, build up, obstructions and silt can cause difficulties in making reliable level measurements in lift station wet wells. New trends in low cost radar units solve ...

Temperature Transmitters | The Perfect Fit for Your Measuring Point

Our video introduces you to the three most important selection criteria to help you choose the right temperature transmitter for your application. We also ta...

2024 Industry Trends | Gas & LNG

We sit down with our Industry Marketing Manager, Cesar Martinez, to find out what is trending in Gas & LNG in 2024. Not only that, but we discuss how Endress...