Simpler SCADA Security Beats More User Training

One of the mantras about good SCADA security is that it is primarily dependent on people and processes, not technology.

Thus if you have an ICS security problem, first look for solutions such as user training or better processes rather than  technology solutions.  This sounds good on the surface, but I’m not sure it’s true.

Performing tasks securely just isn’t part of human nature. Doing them the easiest way possible is. Unless the secure way is also the easy way, security will lose 9 times out of 10.

Cyber Education Test

At the ARC 2010 Conference there was a very good paper by Miles McQueen of Idaho National Laboratory that discussed the effectiveness of cyber education processes. The research team ran a number of tests for bad security practices in a facility with a high level of security.

1. The researchers left 50 infected USB thumb drives distributed in parking lots, around picnic tables, sidewalks, benches etc. and then watched the keys “call home” as people installed the keys in their government computers.
2. The researchers created a phishing email and watched who clicked on the URL.
3. The researchers had a woman call pretending to be from tech support and ask for passwords.

They ran these tests before the staff attended a number of security education courses. Then they ran the tests again a year later. These are some of the results:
 

Training did not Reduce Security Infractions

In two of the three cases, the training had no effect one year later!

But in one case (the USB key) training seemed to be very effective – why? Because during that year Microsoft released Vista SP2 and XP SP3, two service packs that restrict the AutoPlay/AutoRun feature of the operating system, thus preventing the key from calling home. So chances are, the people still installed the USB drive in their computer, but it was prevented by the new OS defaults from calling home.

Now, this experiment was not perfect.  In this case, the experiment was not performed on exactly the same people before the test and one year later.  Also, there was no control or measurement of the quality of the training.  Thus, the scientific rigour of this test could certainly be improved.

However, from my years of experience in working with ICS personnel, I am convinced that the moral of the story would not change, even with stronger test controls. There are two lessons that we need take from this:

1. Security training is not a one-off effort, but must be repeated regularly (probably every six months) if we want it to be effective.
2. Good usability designs that require little or no user effort will fix security – sporatic user training will not.

Both especially apply to ICS/SCADA security, where only a move to simpler solutions and consistant awareness training will ever fix the mess we are in.

Subscribe to the "Practical SCADA Security" news feed