The author Ronald Krutz takes the reader through the various elements of cyber security as it is applied to SCADA systems. Documenting the various protocols and issues in depth the author mentions some very specific threats to cyber security that the information technology practitioner will likely be interested in. I was very intrigued by the section of the book that discussed in depth how the different SCADA protocols worked with each other. When associated with the TCP/IP stack or OSI 7 Layer model SCADA protocols have an interesting cluster of capabilities.
SCADA systems use the OSI 7 layer model and are often simply layered on top of the OSI model. Since SCADA systems must be real time systems and that usually means that they are time and mission critical. More importantly SCADA systems are very sensitive to changes in the network and any type of interruption. For that reason SCADA systems often have no security layered on them as it might impact performance and create an error condition. The author shows in detail how this kind of requirement might be taken advantage of by adversaries. Since the different SCADA system protocols are layered it would thereby be safe to assume that current tools could be bent around that layer to be used specifically against SCADA.
If only there was a taxonomy of the OSI 7 Layer model that listed the tools and what they could be used for when attacking another system. We might be able to quickly target what tools could be adapted.
The book is filled with examples of refineries and nuclear power plants that use SCADA systems and generalizes the problem space to determine the best way to secure the systems. The issue with security is the electrical engineering usually owns the SCADA system and the Information Technology department often owns the network. This silo creates risk to the organization. Unfortunately very few students want to learn SCADA programming.
Over all the book was excellent. I liked it for a possible text book in the future. If I was to teach embedded programming and secure programming in one course this is the book that would explain why it is important. Strong buy recommendation if you are going to be dealing with SCADA.