Over the past month, I have received a number of emails and seen a number of LinkedIn articles suggesting that I was attacking the concept of data diodes when I stated that Air Gaps are a myth. Unfortunately, this is a serious misunderstanding of my message to the ICS/SCADA community.

Finding a way to determine the right level of investment in ICS and SCADA Security has been an ongoing challenge for industry. In an earlier article, the Total Cost of Ownership approach for calculating investment level was described. Today I present another method called Value at Risk (VaR).

In a move that may be helpful for critical infrastructure asset owners, on July 23 the Industrial Control Systems Joint Working Group (ICSJWG) published a new document on a framework for disclosing Industrial Control System (ICS) vulnerabilities.

The discovery of the Flame malware last week focused the cyber security world on the sophisticated strikes targeting energy companies in the Middle East. Although Flame's goal was espionage rather than damaging operations as Stuxnet did, it has been seen as one more indication that the industrial world is now in the bull's eye of clever attackers.

Last week I was in the Middle East, speaking at a very interesting security conference attended by management from the region's major energy companies. Today's blog was going to cover what I learned at this event, but that will have to wait. Instead, in an interesting coincidence, a new super worm called Flame (or sKyWIper), has been discovered targeting sites in the Middle East. So today I will explore what impacts (if any) this new worm will have on SCADA or ICS security.