You're essentially you're willing to trade security of critical infrastructure (and potentially risk lives) for the convenience of being able to do your job from home.
Is a vpn secure?
If Tesla can update the software in a fleet of vehicles remotely why can’t I update the software in a power plant?
Arguably it should not be up to the owner entity as to the security requirements they need to meet. At least down here in Australia we're in the process of legislative reforms that significantly expand both the scope of critical infrastructure (most of which is privately owned) and the responsibilities and requirements of critical infrastructure operators (in terms of risk management, security plans, mandatory reporting, etc.)
>Is a vpn secure?
Teamviewer (which I understand was the vector used in the water system breach) or a VPN that hasn't passed the extensive testing required of secure cryptographic devices is not acceptable.
IF the industrial control systems were treated as a classified information system, were linked using an approved and properly managed [1] secure cryptographic device (on both sides e.g. back to a secure control centre, not to your house so you can work from bed), and generally had the rest of the protective elements (e.g. requiring personnel working on it to hold a SECRET or equivalent clearance proportionate with the value of the system) in place, that might be OK. But otherwise my position remains the same - it should not be remotely controllable via the internet.
>If Tesla can update the software in a fleet of vehicles remotely why can’t I update the software in a power plant?
That might brick some cars on-board computers or "only" kill perhaps a few dozen people before people caught on and it was recalled - still tragic, but small in the grand scheme of things. Critical infrastructure is called that because if it goes wrong it can harm or kill people on a vast scale, so it should be held to far higher standards.
[1] e.g. keymat issued by whatever your equivalent to the NSA is e.g. our Australian Signals Directorate, and otherwise verified to be secure.
Can you recommend any VPNs that are up to the required standard for critical infrastructure?
Although since the power plants I work on would struggle to kill even one person and damaging them would only cause financial hardship for the owner or an insignificant exceedanve of environmental regulations, so they must not be critical.
It is small, lightweight, reliable and does what it is meant to do. It uses existing, trusted network tech in the right ways and due to the low complexity you reading the source code is an realistic option.
But there are userspace implementations and I guess it's should be doable to make them talk to a hardware device.
It's pretty low risk AFAIK, generally cars infotainment and CAN bus are isolated, and I understand Tesla vehicles can't update while driving. Who knows, I'm not familiar with their architecture, but I'm not too worried about it.
There are attacks but IIRC they rely on GPS spoofing, or tricking machine vision to cause the vehicle to swerve or accelerate, you can't just drive someone off a cliff over 4G (at least without implanting hardware into the car).
>Can you recommend any VPNs that are up to the required standard for critical infrastructure?
Approved devices vary by country, but this list is a decent example: https://www.ia.nato.int/niapc/Category/IP-Encryption_25
Unfortunately it's hard to provide info when these kinds of products are not generally available for purchase outside of the defence community, and the user manuals and related documentation are themselves restricted. But generally speaking if it's acceptable for use with classified info then it should be adequate protection for critical infrastructure.
>Although since the power plants I work on would struggle to kill even one person and damaging them would only cause financial hardship for the owner or an insignificant exceedanve of environmental regulations, so they must not be critical.
They might be relatively harmless in isolation, but it could be really harmful if an attacker could compromise a dozen of these small plants and disable or destroy them at the same time so there's less reserve capacity in the grid to pick up the slack when you launch your main attack. You don't even need to have that big of an impact on industry or what have you, just causing a blackout on a hot day and killing a bunch of elderly people via heatstroke would whip people into a panic.
Or perhaps an attacker would compromise one plant and use it as a vector to attack someone like you next time you connect, gain a pivot point via your workstation to set up a persistent backdoor and steal confidential documents and email so they know your schedules and organisational weaknesses, steal your VPN credentials and attack multiple power plants at once when it suits them, etc.
>They might be relatively harmless in isolation, but it could be really harmful if an attacker could compromise a dozen of these small plants and disable or destroy them at the same time so there's less reserve capacity in the grid to pick up the slack when you launch your main attack.
I suppose it depends on what is considered a small power plant. I would say anything less than 20MW is small, greater than 30 MW is medium, and greater than 100 MW is large. Simultaneously tripping a dozen 20 MW power plants would result in a loss of 240 MW of generation, about the same as 2 large units. There is 258,000 MW of nameplate generation on the western north american grid and a peak load of about 150,000 MW. The link below [0] shows that transmission level operators are looking at 1000's of MW of lost generation to have a measurable impact on the grid but losing that amount of generation causes operational headaches and not automatically an outage.
[0]: https://www.wecc.org/Reliability/2013-10%20WECC%20JSIS%20-%2...
https://www.homeaffairs.gov.au/reports-and-publications/subm...
https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...
The CI cybersecurity reforms are part of the overall 2020 cybersecurity strategy (https://www.homeaffairs.gov.au/about-us/our-portfolios/cyber...), there's a lot of changes happening in the sector at the moment. If you have an interest in cybersecurity now would be a good time to grab some certifications and be ready to jump on board, as there's expected to be a big demand for cybersecurity professionals over the next few years to support these initiatives.
This looks like a decent summary of the proposed changes: https://www.ashurst.com/en/news-and-insights/legal-updates/m...
OTA updates to car firmware is widely considered to be a stupidly irresponsible idea. I don't think we should justify doing risky things by pointing at other people doing risky things, who only get away with that because of clout and regulatory wheels turning slowly.
On one hand, it opens the door to hacking, pushing a malicious update, etc (stuxnet much?). On the other hand, if it is never updated, then we will end up with a zombie network consisting of lightbulbs, fridges, and teapots (yes!)
Edit: sorry I could not resist adding teapots (HTML error 418)
OTA updates, and car security in general, is a joke it's so bad.
Teslas are great cars in many ways, but cybersecurity is not one of those ways if you go by pentest reports. I stopped at listing five below, but there are quite a few more out there.
https://www.forbes.com/sites/leemathews/2020/11/23/researche...
https://www.forbes.com/sites/daveywinder/2020/02/19/hackers-...
https://electrek.co/2020/06/10/tesla-hacker-unlocks-performa...
https://www.zdnet.com/article/tesla-car-hacked-at-pwn2own-co...
https://insideevs.com/news/356769/video-tesla-model-3-hacked...