The warnings of the threats are extremely important as they are becoming more frequent. But much of the language in these articles is not helpful and often misleading
As an example this article, and many like it, use subtle word choices like noting that penetrating the control centers was “easy” and that it was “hundreds of victims” but not necessarily hundreds of control centers which is what they’re referring to when discussing “black outs”
Then there’s the almost mocking note that supposedly these networks were supposed to be air gapped; except no one serious in the discussion considers control centers for electric grid functionality air gapped. It’s subtle but positions that this is a shock but it’s not
Then there’s the straight sales pitch by DHS noting that they’ve been briefing people with security clearances about this for awhile. Except the DHS learned about this from the private sector community. Very few details were classified.
And language such as “throwing switches” and noting it would cause “black outs” is in no way representative of what was seen in these intrusions. In these cases the adversary was taking screenshots of HMIs.
The difficulty of the attack was covered by @cnoanalysis and I here last September: fortune.com/2017/09/11/dra… and the language being used by folks on “black outs” it’s not being portrayed accurately
So in short, please take cyber threats to industrial infrastructure serious. They are getting far more aggressive and numerous. But let’s not use word choices that mislead and hype up the issue. It’s bad enough without added fear.
And because I don’t think it gets said enough these days - I do think the people in DHS and NSA working on this need a huge kudos. It’s not exactly an easy time to be in govt and our risk is growing. So I’ll point out where we can get better but also thank you.
