The friend and colleague Andrea Zapparoli Manzoni he points out an interesting piece of news that makes us reflect on where we are in terms of infrastructure protection: SCADA Systems Offered for Sale in the Underground Economy.
It is not the first time that there has been news of control and remote control systems exposed on the Internet. As recently as a few weeks ago we published the map of Italy covered by blue dots of IP addresses reachable via the network. Some colleagues have also commented on the news with interesting arguments.
Now we are at the supermarket, or rather the ebay, of the IP addresses of control systems exposed and reachable on the net, with also the Try-&-Buy concept, to give more substance to the commercial proposal.
The one we see above is the screenshot of a screen of a control system of a hydroelectric plant in some Haute-Marne valley in the Champagne-Ardenne region.
Nothing particularly critical or sensitive: the plant probably supplies electricity to the nearby community, and a possible blackout would at most only local effects.
There could certainly be an interruption of the service and the lack of turnover for the energy not supplied by the owner company that manages the plant, which if it were in Italy would correspond to a tidy sum (which would certainly contribute to a calculation of the SWRI absolutely positive to think about how to protect these systems).
However, we must ask ourselves whether any repercussions due to the interdependencies between infrastructures could possibly produce "domino effects" that can generate greater damage, side effects (unwanted?!?) from possible "saboteurs via the web" with potential risks for the integrity of people and the environment.
In conclusion: it is clearly better NOT to expose control and remote control systems on the internet! There are different ways to make them equally reachable only by those who have the task of maintaining and managing them remotely, in a safe and above all "protected" way!
If you have any doubts and Would you like to know more, let's talk about!