Jake Brodsky
Jul 25, 2017 · 2 min read

Cyber attacks aren’t war crimes. They’re crimes against utility ratepayers. It’s negligence and it’s arrogance, and there is a whopping dose of pure unadulterated, deep seated ignorance. That goes for IT, for Operations, and for Engineering.

You IT people think you know what you’re doing. It sorta works for you in the office. What you don’t realize is that this isn’t just another information system. There is a physical reality that continues to run even after you have made the information safe. News flash: We don’t care about the information. We care about the process. Plants need your technological assistance, but your priorities are all screwed up.

Operations: If you think those IT people are lying about the threat, you need a new pair of eyes and ears. The Internet is not your friend. The wireless I/O systems you use are a wonderful back door that can be used to hack you remotely. Security is not a gadget. Security is knowledge of your controls, policies, and diagnostics. We can not afford to be Homer Simpson any more (and there are more Homer Simpsons in Operations than any of us would like to admit).

Engineering: Security starts with a safe process. Stop designing with statistics and start looking at the process in a way that would allow people to break the systems down gracefully. The days of the big controller of everything that you put in because it was cheaper are over. Learn to use and monitor networks. Learn to segment processes so that they can operate independently if needed. Design some forensics capability in to the process so that you can learn from your mistakes. And for crying out loud, if you’re working on infrastructure DO NOT OUTSOURCE. Yeah, it looks like you saved a lot of money until your very first major incident. Then you find out the limits of what an outsourced aaS contract really are. And please talk to the IT people and learn some IT. You can’t use their methods, but you can use their technological advice.

How do I know this? I’ve done the Operations, the IT, and the Engineering for 30 years at a large water utility. And unlike most consultants, I have actually lived with the results of the decisions I have had to make.

This is not a war crime. This is a massive case of social misalignment. When we address this issue, there won’t be many opportunities to commit those war crimes in the first place.

    Jake Brodsky

    Written by

    I am one of those right wing conservative, married white fathers. Happy, not angry; armed, not dangerous; educated, but always a student.