Once in a while we find the terms SCADA systems and security breach in the same news piece. The mere coupling of these two terms together is enough to send a shiver through most people's spines. SCADA ((Supervisory Control and Data) systems are the driving force behind the most basic services of modern civilizations: power plants, dams, water systems and traffic control systems. Thus, an attack aimed at such systems can severly impair a modern nation in the worst case.

The most recent incident involving security vulnerabilities in SCADA system showed up last week, as news broke up regarding a worm attacking WinCC software from Siemens. Putting aside the smoke screens and the FUD spread around this story allows us to understand the true nature of "SCADA attacks" and point out the tools that would help organizations deflect them.

To begin with, the initial infection vector used an unpatched Windows operating system vulnerability. This vulnerability is weaker than most recently announced vulnerabilities, as it only allowed the attack to be launched through a media physically conntected to a workstation. This vulnerability allowed the attacker to execute arbitrary code on the compromised workstation. This particular attacker chose to "attack" the WinCC software. The vulnerability eploited by the attacker was actually a factory set password to the system's database. Thus, the attack code did not actually interface with the code of the WinCC software but rather with the database server it uses. An analysis of the code shows that the attack consisted of extracting information from the database and sending it over to an attacker controlled server. Much the same way, the attacker could have changed the password on the account in the database server, putting the system out of service or tampering with the contents of the database, yielding unimaginable effects.

So, while "SCADA" security is an enigmatic domain, database activity monitoring and security is actually a pretty established one. It means that if we take the mistery out of SCADA security and apply a component by component security measures we could actually make our SCADA systems secure. In fact, by using a database firewall enterprises could have mitigated this recently described attack altogether!

 This is not the first time we've discussed this approach to SCADA security and it will probably not be the last one. While SCADA systems do pose a different threat profile with respect to the consequences of an attack and some unusual IT components, at the bottom line this are modern IT systems relying for their management on standard operating systems, standard commercial database and most often a web interface. Let's use the good tools we have to protect those.